WPK quality-control commission adopts revised peer-review guidance

On 9 October 2026 the Kommission für Qualitätskontrolle (KfQK) unanimously resolved to adopt revised versions of its Hinweis zur Durchführung und Dokumentation einer Qualitätskontrolle and its Hinweis zur Berichterstattung über eine QualitätskontrolleWPK; the texts were published on 22 October 2026WPK. They now frame how registered Prüfer für Qualitätskontrolle plan, perform, document and report statutory quality controls of every practice that conducts Abschlussprüfungen nach § 316 HGB. At the same time the KfQK withdrew its 2016 Hinweise on Qualitätskontrollen bei Sozietäten und Partnerschaften and on Prüfung der Vollständigkeit der GrundgesamtheitWPK, folding their content into the revised Durchführungshinweis.

The revision carries the WPO amendments and the June 2024 Berufssatzung WP/vBP changes transposing ISQM 1, ISQM 2 and ISA 220 (Revised), including the kritische Grundhaltung duty of § 37 BS WP/vBP, into review practice, and absorbs lessons from evaluations of past quality-control reports — notably on controls of large and mixed practices and on documentation. A new mapping annex translates the Qualitätssicherungssystem components of WPO and Berufssatzung into ISQM 1 components, while the traditional Dreiklang of Praxisorganisation, Auftragsabwicklung and Nachschau is retained. The KfQK deliberately adopted the texts without waiting for the still-pending CSRD-Umsetzungsgesetz.

Reviewers must keep a kritische Grundhaltung from planning onwardsWPK: they probe complaints and whistleblowing signals, challenge the practice's own risk assessment against their experience, and question the relevance and reliability of audit evidence throughout. The engagement review itself (Auftragsprüfung) may be performed only by WP/vBPWPK — fachliche Mitarbeiter may only supply ancillary support, for example preparing population evaluations, and that support must not extend to the substantive review itselfWPK, while specialists such as IT auditors may be called in. Support hours must be shown separately in the report. For larger practices with many engagements and professionals the Hinweis recommends a three-stage selection modelWPK: first test the effectiveness of the practice's own Nachschau on a risk-based sample, then select at least as many engagements that the Nachschau did not cover, and finally critically review the overall coverage including the responsible partners involved. Any departure from this model must be convincingly justified in the reportWPK. Where the files do not let the reviewer reconstruct the auditor's work, the work is presumed not doneWPK: the practice must show documented traces of its actions, and engagements averaging less than one reviewer day must be explained. Engagement files must be closed promptly, no later than 60 days after the BestätigungsvermerkWPK.

The Qualitätskontrollbericht must describe the practice's own risk-assessment process — which may be annexed — the structure of the Grundgesamtheit, the risk-based selection criteria, how the three-stage model was applied or why it was departed from, and the reviewer's procedures and findings on organisation, engagements and Nachschau, following the structure of § 51 BS WP/vBP. For mixed practices the reviewer additionally describes the Nachschau system with its Konsequenzenmanagement and the Geldwäschegesetz arrangements where the Transparenzbericht does not show them. The verdict stays negatively formulatedWPK, rendered with the erforderliche Sicherheit the statute demands.

The drafts went to the professional associations in February 2026; IDW, DWP and wp.net filed statements, and the KfQK's reply letters dated 12 October 2026 were published alongside the final texts and reworked working aids covering practice data, population and selection tables, an engagement-review example and a findings-assessment aid.

Legal basis: the revised KfQK Hinweise (Stand 9. Oktober 2026), konkretising the Satzung für Qualitätskontrolle under §§ 57a ff. and 55b WPO and the Berufssatzung WP/vBP.