How to Document AI Use Under SQMS No. 1, the AICPA Quality Management Standard

Do the AICPA quality management standards cover AI tools?

Yes. SQMS No. 1, A Firm's System of Quality Management, applies to firms that perform engagements under the SASs, SSAEs and SSARSs, and its resources component includes a quality objective for technological resources. The standard expects appropriate technological resources to be obtained or developed, implemented, maintained and used to enable both the system of quality management and the performance of engagements. An AI tool that drafts workpaper memos, summarizes contracts or tests journal entries is a technological resource under that objective.

The timing makes this a year-end item. Firms had to design and implement their systems by December 15, 2025. The first evaluation of the system is due within one year of implementation, which for most firms means by December 15, 2026, and annually after that. If staff started using AI tools during 2026, the evaluation should show how the firm handled them.

The AICPA has also addressed AI directly. Its October 13, 2026 practice aid, Artificial Intelligence (AI) Considerations for Financial Statement Auditors, includes a section on audit firms' own use of AI tools. It calls for firm quality management policies covering AI tools and describes engagement partners' responsibilities to understand, approve and oversee the AI tools their staff use.

What does SQMS No. 1 expect the documentation to show?

SQMS No. 1 does not prescribe a format for documentation. It addresses sufficiency. For AI, sufficient documentation connects four things: the quality objective, the risks the tool creates, the firm's responses to those risks, and evidence that the responses operated.

That traceability is what turns a policy into evidence. A firm that can show "we approved this tool, here are the settings, here is who reviewed its output on these engagements" gives the person evaluating the system, and later a peer reviewer, something to test. A policy memo with nothing behind it does not. Journal of Accountancy guidance on right-sizing SQMS No. 1 documentation also suggests that when a response is automated in software, firms keep configuration snapshots and change logs as evidence.

Which AI risks belong in the firm's risk assessment?

The risks that matter are the ones that could affect engagement quality or client confidentiality. For most firms using generative AI, five belong in the risk assessment:

• Inaccurate output: the tool produces a wrong figure, citation or summary that reaches a workpaper or report without detection.
• Confidentiality: client information goes to a vendor without the safeguards the AICPA Code requires, for example when staff paste client tax documents into public AI tools.
• Unapproved tools: staff use personal AI accounts the firm cannot see or control.
• Changing tools: a vendor updates its model or settings, and output the firm validated last quarter behaves differently now.
• Competence: staff use a tool without training on its limits or on the firm's review requirements.

Each risk needs a response, an owner and a frequency. The confidentiality risk has specific rules behind it. AICPA interpretation ET 1.700.040 requires a member, before disclosing confidential client information to a third-party service provider, to either have a contract requiring confidentiality and reasonable assurance of the provider's procedures, or obtain specific client consent. For tax information, Section 7216 and its regulations make knowing or reckless disclosure by a preparer a misdemeanor. Firms that prepare returns are also financial institutions under the FTC Safeguards Rule, which requires service provider oversight through contract and periodic assessment.

What records should a firm keep for each AI tool?

Keep one short record per approved tool, plus engagement-level evidence. The tool record is the firm-level response. It should include:

• The tool name, version or plan, and the business purpose it was approved for.
• Who approved it and when, and who is responsible for it day to day.
• The contract terms that matter: whether the vendor trains on firm data, how long it keeps prompts and files, and the confidentiality commitments that satisfy ET 1.700.040.
• The configuration: firm accounts with multifactor authentication, data retention settings and any features turned off.
• The validation performed before use: what the firm tested, on what sample, and the result.
• The training staff received and the date.
• A change log: vendor updates, setting changes and any revalidation.

At the engagement level, the evidence is simpler. Record which AI tool was used, for what step, and who reviewed the output against source documents. A line in the workpaper or a field in the engagement software is often enough. The practice aid's point about partner responsibility applies here: the engagement partner should be able to say which tools the team used and that they were approved.

How does AI fit into monitoring and the annual evaluation?

Monitoring is where the firm checks that its AI responses actually operated. Pick a sample of engagements and confirm that the tools used were on the approved list, that output was reviewed, and that no restricted client data went into tools outside the firm's control. Record what was inspected, when, by whom and the result. Treat any gap as a finding with a root cause.

The individual with ultimate responsibility for the system, usually the managing partner, then uses those monitoring results in the annual evaluation. Technology can help with evidence. Sign-in logs show which AI services are connected to firm accounts. Data loss prevention reports show attempts to paste client data into unapproved AI sites. Both give the monitoring partner facts instead of survey answers.

What should a CPA firm do before the December 15, 2026 evaluation?

Inventory the firm's AI tools, approve or retire each one, add AI risks to the risk assessment and run one monitoring inspection before the evaluation. In order:

1. Inventory the AI tools in use, including tools built into tax, audit and practice management software. Check sign-in logs for AI services connected to firm email addresses.
2. Approve or retire each tool. For each approved tool, complete the short record above.
3. Add the five AI risks to the risk assessment, with a response, owner and frequency for each.
4. Add an AI step to engagement documentation: tool used, step performed, reviewer.
5. Run one monitoring inspection on a small sample before the evaluation and document the results.
6. Keep configuration snapshots for any automated control, such as blocking unapproved AI sites, so the evidence exists when the reviewer asks.

How s90 helps

s90 supports CPA firms with the technology side of quality management: AI guardrails that keep firm tools on firm accounts, alerts when staff sign up for new AI services, and data loss prevention reports that show what was blocked and when. We can export configuration snapshots and logs in a form your quality management documentation can use. If you would like help assembling AI evidence before your evaluation, we are glad to help.