Welcome back to Genuine Learning Blog! This week, we’re diving into an important release from the Government Accountability Office (GAO): their official responses to frequently asked questions about establishing and maintaining a system of quality management (QM). If you’ve been navigating the new requirements, this post will help clarify the key points, and what they mean for your organization’s quality management processes.

Why Did the GAO Release This FAQ?

As Alex Romero explains, the GAO published this FAQ document on December 15, 2025, the same day that audit organizations were required to have their QM systems implemented. The release timing wasn’t ideal, and many practitioners wished for the information earlier. Fortunately, there’s nothing groundbreaking in the guidance or anything that should drastically change existing systems, if you’ve already developed yours based on the 2024 Yellow Book.

If you audit federal government entities, there’s some breathing room: due to the recent lapse in appropriations, you may defer the QM design and implementation until March 16, 2026.

What Does the Document Cover?

The guidance is organized around three main topics:

1. Quality Management & Risk Assessment Process: Understanding and managing risks to quality objectives, and how this process is a continual loop, not a “set it and forget it” exercise.
2. Monitoring & Remediation: Integrating ongoing monitoring with risk assessment, including how frequently risks should be revisited and who should be involved.
3. Engagement Quality Reviews: Clarifying what’s expected of reviewers and the difference between review types.

Highlights from the FAQ Sections

Section 1: Quality Management & Risk Assessment

• Do you need an entirely new set of policies & procedures?

  Not necessarily. If you had clean peer review results under the 2018 requirements, you likely just need to update existing policies to meet the 2024 Yellow Book and current QM expectations.

• When does the initial risk assessment need to be performed?

  By December 15, 2025. That risk assessment should form the basis of your quality management system, don’t wait until after you implement.

• Do all quality objectives have to be addressed?

  Yes. Every risk to the required quality objectives must be identified and mitigated.

• Is there a GAO template for QM?

  No GAO template, but other organizations like the AICPA provide helpful resources.

Section 2: Monitoring & Remediation The document emphasizes a continuous, cyclical process, integrating risk assessment with monitoring. Small firms don’t have to hire an external body to monitor their QM system, though outside eyes may help prevent bias.

Section 3: Engagement Quality Reviews

• Does the reviewer need Yellow Book CPE if not performing Yellow Book engagements?

  No, but check for other Yellow Book-specific requirements before moving ahead.

• How can firms issue timely reports with the review requirement?

  Plan ahead! Reviews can, and should, occur during the audit process, not just at the very end.

Key Takeaways

• The GAO FAQ document addresses common concerns about establishing, implementing, and maintaining QM systems.
• No major new requirements, just helpful clarifications, especially for those finalizing their systems.
• The FAQs cover performing robust risk assessments, integrating ongoing monitoring, and understanding the nuances of engagement quality reviews.

As Alex notes, these answers provide reassurance as we move forward with QM implementation. If you’re a federal government audit organization, don’t forget the deferred deadline.