Peer review documentation package for CPA firms using offshore staff.

What peer reviewers actually look at

Under the AICPA Peer Review Program, CPA firms performing audit, review, compilation, or attest engagements undergo peer review on a triennial cycle. The peer reviewer's job is to evaluate whether the firm's quality control system is designed and operating effectively. When a firm uses third-party (including offshore) staffing on engagements subject to peer review, the reviewer will look at specific documentation to confirm:

• The firm's policies and procedures address the use of third-party service providers.
• The firm exercised appropriate oversight of third-party personnel.
• Confidentiality obligations were appropriately handled (AICPA §1.150.040).
• The engagement partner maintained responsibility for the engagement.
• Workpapers demonstrate review and sign-off by the engagement team.

These aren't heavy lifts. A firm with reasonable documentation practices already has 80–90% of what a peer reviewer will ask for. The purpose of this page is to help firms consolidate that documentation into a clean package so peer review goes smoothly rather than becoming a scramble.

The peer review findings we see most often

• §1.150.040 disclosure not documented. Firm has been using offshore staff for a year; engagement letters don't mention third-party providers; peer reviewer flags this as a quality control deficiency. Fix: update engagement letter template and re-issue to active clients.
• Individual NDAs missing for staff assigned to attest engagements. Entity-level NDA exists but individual offshore staff working on audits don't have personal NDAs. Fix: obtain individual NDAs retroactively and include going forward.
• Supervision model not documented. Firm used offshore staff on 6 audits but there's no written record of how each engagement was supervised, who reviewed what, or when. Fix: build standard supervision documentation template for future engagements; retroactively document where possible.
• Review sign-offs unclear in workpapers. Workpapers show preparer initials but no reviewer sign-off, or sign-offs not dated, or EQCR sign-off missing. Fix: strengthen workpaper review procedures; train team on documentation expectations.
• Firm lacks documented quality control policy. No written QC policy addresses third-party providers. Fix: update firm's quality control document to explicitly cover offshore provider engagement and oversight.
• Training records unavailable. Offshore staff worked on 2026 audits but the firm can't produce training records showing the staff received training on the audit methodology. Fix: obtain training records from offshore provider and maintain going forward.

For the service scope that sits under this peer review documentation, see offshore audit support. For CPA firm engagement economics generally, see CPA firms page.