The International Auditing and Assurance Standards Board (IAASB) issued three exposure drafts for quality management at firm and engagement levels in February 2019 with a deadline for comment of 1 July 2019. The suite of quality management exposure drafts includes ED-ISQM 1 discussed here
This article provides an overview of the introductory paragraphs to the proposed International Standard on Quality Management 1 (previously International Standard on Quality Control (ISQC) 1), Quality Management for Firms that Perform Audits or Reviews of Financial Statements, or Other Assurance or Related Services Engagements (ED-ISQM 1).
Scope of ED-ISQM 1
ED-ISQM 1 deals with the firm’s responsibility to design, implement and operate a system of quality management (SQM). This standard is not only applicable to audits of financial statements. Reviews of financial statements, audit and review engagements other than those relating to historical financial information and other assurance or related service engagements, including compilation engagements are also within the scope of ED-ISQM 1.
In drafting the new and revised requirements, the IAASB was tasked with enhancing the scalability of quality management standards to make them practically usable; not only by firms entering into audit engagements but also by firms that enter into the different types of engagements, as discussed above. To this end, a risk-based approach that takes into account the nature and circumstances of the firm, as well as the types of engagements performed, has been introduced into ED-ISQM 1.
ED-ISQM 1 recognises that the complexity and formality of the SQM will vary across firms. Since firms are required to adapt the risk-based approach to suit the nature and circumstances of both the firm and the related engagements performed, it is expected that a firm’s SQM will change over time in response to identified changes.
The firm’s system of quality management
Paragraph 7 of ED-ISQM 1 states that the purpose of an SQM is to support the consistent performance of quality engagements by providing the firm with reasonable assurance that the objectives of the system are achieved. The standard continues to recognise that the public interest is best served by the consistent performance of quality engagements. The performance of quality engagements is achieved by planning, performing and reporting on them in accordance with professional standards, as well as applicable legal and regulatory requirements.
With the professional standards being largely principles-based, the practitioner is required to exercise professional judgement and, where applicable to the specific type of engagement, professional scepticism to achieve the objectives of quality engagements.
ED-ISQM 1 is organised according to eight components which form the SQM, as follows:
- Governance and leadership
- The firm’s risk assessment process
- Relevant ethical requirements
- Acceptance and continuance of client relationships and specific engagements
- Engagement performance
- Information and communication, and
- The monitoring and remediation process
The eight components and their interrelationships are illustrated in diagram 1.
Although ED-ISQM 1 sets out the eight components in a linear manner, an SQM is not linear in nature. This process is continual and iterative and each of the eight components are highly integrated. The requirement for the SQM is designed to enable the firm to achieve the objective of ED-ISQM 1 and the proper application of the requirements is expected to provide a sufficient basis for the achievement of the stated objective. A firm is required to exercise professional judgement in the design, implementation and operation of an SQM, taking into account the nature and circumstances of the firm and the engagements.
Leadership and governance provide the foundation to the SQM and the framework within which firm decisions are made. To this end, ED-ISQM 1 requires a firm’s leadership to demonstrate a commitment to quality through actions and behaviours, thereby setting the tone at the top and establishing an environment and firm culture conducive to the performance of quality engagements.
The risk-based approach to quality management requires the firm to:
- Establish quality objectives
- Identify and assess risks to achieving the quality objectives, and
- Design and implement responses to address the assessed quality risks
ED-ISQM 1 includes components that cover aspects that are fundamental to the performance of a quality engagement, namely relevant ethical requirements and acceptance and continuance of client relationships and specific engagements. In support of the SQM, ED-ISQM 1 includes resources and information and communication as two of the required components.
A key element to the implementation of an effective SQM is monitoring the process to identify deficiencies, understanding the root cause of identified deficiencies and responding to these by taking remedial action. ED-ISQM 1 recognises that the findings from monitoring may also identify positive practices. There is no explicit requirement for the firm to take further action in response to a positive finding. ED-ISQM 1 does, however, encourage firms to consider positive findings to identify good practices that the firm can implement in other areas to enhance the SQM. The information generated from the system of monitoring and remediation provides the firm with information to be used in assessing whether the SQM provides reasonable assurance that the objectives of such a system have been achieved.
The objective of ED-ISQM 1, as stated in paragraphs 18(a) and (b), is for the firm to design, implement and operate an SQM for all engagements within the scope of the standard that provides the firm with reasonable assurance that:
- The firm and its personnel fulfil their responsibilities in accordance with professional standards and applicable legal and regulatory requirements, and conduct engagements in accordance with such standards and requirements; and
- Engagement reports issued by the firm or engagement partners are appropriate in the circumstances
The IAASB is of the view that the consistent performance of quality engagements is key to the firm’s responsibility to act in the public interest. Although the objective of ED-ISQM 1 does not specifically mention public interest, the connection between the public interest role and the objective of ED-ISMQ 1 is explained in paragraph 7. Here, the view of the IAASB is echoed in stating that the public interest is served by the consistent performance of quality engagements. The firm’s public interest role is then included in paragraph 23(c), where it states that the firm’s strategic decisions and actions, including financial and operational priorities, demonstrate a commitment to quality and to the firm’s role in serving the public interest, by consistently performing quality engagements.
The definitions section of ED-ISQM 1 did not escape the redrafting process. An addition to the list of definitions is the term ‘deficiency’. This is a significant definition in that it acts as a trigger to other requirements within the SQM, namely the performance of a root cause analysis and the implementation of remedial action in response to the identified deficiency.
Another revised definition worth noting is that of ‘engagement team’. Concerns were noted around the definition of the engagement team included in extant ISQC 1, in that it was not always clear who was included or excluded from the engagement team. This had a knock-on effect in determining who had to comply with the requirements applicable to a member of the engagement team.
Applying, and complying with, relevant requirements
ED-ISQM 1 requires the individual who has been assigned ultimate responsibility and accountability for the SQM, as well as those assigned operational responsibility to have an understanding of ED-ISQM 1 relevant to the assigned responsibilities. This understanding includes the objectives and the proper application of the requirements in ensuring that the objective is ultimately achieved.
Firms are required to comply with each and every requirement of ED-ISQM 1 unless it is not relevant due to the nature and circumstances of the firm or its engagements.
The objective of the firm in the context of ED-ISQM 1 is to design, implement and operate an effective and efficient SQM. The SQM is aimed at ensuring that the firm and its personnel fulfil their responsibilities and conduct engagements in accordance with the professional standards and applicable legal and regulatory requirements and that reports issued are appropriate. Consistently achieving these objectives will go a long way in enhancing audit quality, thereby sustaining the profession’s position in serving the public interest.
Hayley Barker Hoogwerf, Project Director: Assurance at SAICA
This article was originally published in the July 2019 issue of ASA.