Quality management in an audit firm: ISQM 1 and ISA 220 (Revised)
Audit quality does not depend only on the skill of one auditor: at firm level there is an eight-component system (ISQM 1), and at the level of each engagement the engagement partner's responsibility (ISA 220). Tables and practical situations using a hypothetical small audit firm.
"Pishtoq Audit" LLC is a small audit firm: two partners and eleven staff. Three things happened in one week. A new client offered a fee twice the usual and asked for the report "quickly". An experienced manager resigned, and two of his engagements passed to a new staff member. And an internal inspection found that one audit file from last year did not record the reason for a significant change to the plan. All three situations come down to one question: how does the audit firm manage audit quality?
Conditions: the audit firm, names and situations are hypothetical, compiled by the author.
In Uzbekistan the international standards on auditing are the standards of auditing activity (Law "On Auditing Activity", Article 9). The International Auditing and Assurance Standards Board (IAASB) regulates quality at two levels: at firm level ISQM 1, at the level of an individual audit engagement ISA 220 (Revised). Engagement quality reviews are governed by a separate standard, ISQM 2.
How do firm level and engagement level differ?
| ISQM 1 (firm level) | ISA 220, revised (engagement level) | |
|---|---|---|
| Whom it addresses | the whole audit firm | one audit of financial statements |
| Main person responsible | the individual(s) assigned ultimate responsibility for the system | the engagement partner |
| Main question | has the firm built a system capable of delivering quality work? | was quality achieved in this particular audit? |
| Application date | the system had to be designed and implemented by 15 December 2022 | audits of periods beginning on or after 15 December 2022 |
Which eight components make up ISQM 1?
ISQM 1 applies a risk-based approach: the firm sets quality objectives, identifies the risks that threaten them and designs responses. The components operate in an integrated way, not in sequence. For six components the standard sets mandatory quality objectives; risk assessment and monitoring are structured as processes.
| Component | Content | Example at "Pishtoq Audit" |
|---|---|---|
| 1. The firm's risk assessment process | setting quality objectives, risks and responses | once a year the partners update the list of risks: staff leaving, clients from new industries |
| 2. Governance and leadership | leadership's commitment to quality, allocation of responsibilities and resources | a partner responsible for quality has been appointed; bonuses depend not only on revenue but also on quality |
| 3. Relevant ethical requirements | compliance with independence and other ethical requirements | at the start of every engagement staff complete an independence declaration |
| 4. Acceptance and continuance | the decision to take on an engagement or not | a double fee and a demand for "a quick report" are assessed as a risk indicator |
| 5. Engagement performance | direction, supervision, review, consultation, resolving differences of opinion | internal consultation on a complex matter is mandatory, its outcome is recorded in the file |
| 6. Resources | people, technology, intellectual resources | the departed manager's engagements were moved under the supervision of an experienced partner |
| 7. Information and communication | obtaining and communicating the information the system needs | a monthly internal bulletin on changes in standards |
| 8. Monitoring and remediation process | checking that the system works, finding the cause of a deficiency and fixing it | completed files are inspected on a sample basis; training was held on the deficiency found |
The individual(s) assigned ultimate responsibility for the system evaluate it at least annually and conclude whether the system provides reasonable assurance that the quality objectives are being achieved. The first evaluation had to be performed within one year after 15 December 2022.
What does ISA 220 require at engagement level?
The revised ISA 220 defined the engagement partner's role more precisely. The engagement partner takes overall responsibility for managing and achieving quality on the audit engagement and is sufficiently and appropriately involved throughout the audit. The standard also contains a final "stand-back" requirement: at the end of the audit the engagement partner determines that this overall responsibility has actually been taken.
This applies directly to the second event at "Pishtoq Audit": the manager leaving does not release the engagement partner from responsibility. On the contrary, the partner must review the new staff member's work more.
What is an engagement quality review?
For some engagements the firm adds an extra layer of protection: a specialist who did not take part in the engagement objectively reviews the significant judgments and conclusions. The appointment, eligibility and responsibilities of the reviewer are set out in ISQM 2. Which engagements need such a review is determined by ISQM 1 and the firm's policy.
How the three situations were resolved
| Situation | Which component or requirement | What the firm did |
|---|---|---|
| Double fee and "a quick report" | acceptance and continuance; ethical requirements | the partners renegotiated the terms with the client, the deadline was matched to the scope of the audit; otherwise the engagement would not have been accepted |
| An experienced manager resigned | resources; engagement partner involvement under ISA 220 | the engagement partner started reviewing the new staff member's work every week |
| The file did not record the reason for a change to the plan | monitoring and remediation | the cause was investigated (the template had no dedicated section), the template was supplemented, short training was held for the team |
How does this help the client company?
When choosing an auditor, you can look not only at the price but also at the firm's way of working: who the engagement partner is, how involved they are in the audit, whether there are internal consultations on complex matters. A firm that answers these questions clearly usually works in an orderly way.
Test yourself
5 questions on this topic: pick an option or reveal the answer.
Which three main inherent risk factors does ISA 540 (Revised, auditing accounting estimates) single out when assessing risks for accounting estimates?
Which standard governs quality management at the level of an individual audit engagement for financial statements?
Under ISA 315 as revised in 2019, how many components make up an entity's system of internal control?
Under the IESBA Code of Ethics, an auditor must not knowingly be associated with a report or other information that they believe is false or misleading. Which fundamental principle does this requirement belong to?
Under the IESBA Code of Ethics, which fundamental principle includes the auditor's duty to take steps so that staff working under their authority have appropriate training and supervision?
Answered: 0 / 50 of 5 correct
All tests →See also
Sources
- Law of the Republic of Uzbekistan "On Auditing Activity" (25 February 2021, No. ZRU-677), Article 9 · international standards on auditing are the standards of auditing activity
- ICAEW: ISQM 1 and the small practice · eight components; the system had to be designed and implemented by 15 December 2022
- IFAC: Getting Started with the New IAASB Quality Management Standards: Overview · the components operate in an integrated way, not in sequence
- ICAEW: ISQM1 quality assurance monitoring update (August 2024) · all audit firms should have completed a first evaluation of their system of quality management by 15 December 2023; further evaluations at least annually
- IAASA: revised quality management standards · ISA 220 (Revised) applies to audits of periods beginning on or after 15 December 2022
- ICAEW: Overview of standards (quality management in audit firms) · ISA 220 (Revised): the engagement partner's role and involvement throughout the audit; ISQM 2: engagement quality reviews
- ACCA: ISQM 2 (technical article) · appointment, eligibility and responsibilities of the engagement quality reviewer
- Audit firm, names, situations and tables · compiled by the author, hypothetical