In February 2019, the IAASB released exposure drafts for quality management at firm and engagement levels for public comment. This article provides an overview of the key proposed changes in the new and revised requirements
By Hayley Barker Hoogwerf
The outcome of the International Auditing and Assurance Standards Board’s (IAASB) quality management project will change how firms manage quality. The question on every practitioner’s mind is what has changed and how will this impact me.
1. A new risk-based approach to the firm’s systems of quality management in ED-ISQM 1
The IAASB was tasked with drafting a standard that improves the robustness of firms’ system of quality management but at the same time addresses the concerns around extant ISQC 1, Quality Control for Firms that Perform Audits and Reviews of Financial Statements and Other Assurance And Related Services Engagements (ISQC 1), not being scalable to fit the needs of all firms regardless of the size, complexities and circumstances.
The IAASB concluded that the introduction of a new quality management approach that incorporates a risk assessment process focused on proactive identification and response to identified risks to quality would best improve and enhance the robustness of a firm’s system of quality management while improving the scalability of the standard. The new quality management approach requires a firm to design and implement a system of quality management that is customised and suited to the nature and circumstances of the firm and the engagements that are performed. In terms of the risk assessment process that forms part of the system of quality management, firms are required to establish quality objectives, identify and assess quality risks and design and implement responses thereto.
In essence, the system of quality management requires a change from a mindless, tick-box exercise of establishing policies and procedures that address standalone elements of quality control to an integrated, proactive approach that reflects upon an entire system and requires continuous monitoring and remediation.
2. Modernising the standards
The environment in which audit, assurance and other related service engagements are performed is continuously changing and the resources used in performing such engagements is evolving. Firms are increasingly making use of technological resources, including software that may be developed internally by the firm or sourced externally. The use of shared service centres and other external service providers is also on the increase.
As part of the quality management project, the IAASB was tasked with modernising the standards to address the needs of the evolving and increasingly complex environment. To this end, ED-ISQM 1 includes new requirements addressing the use of technology, both in the performance of the engagement and within the system of quality management. Furthermore, the requirements relating to networks have been revised and enhanced and new requirements relating to service providers added. In keeping the standards fit for purpose as the environment continues to evolve, the new and revised requirements are principles based.
3. Improving firm governance, including increasing firm leadership responsibility and accountability
In determining the key components of a system of quality management, the IAASB agreed that retaining the current elements of extant ISQC 1 was appropriate as they reflect topics relevant to a firm’s system of quality management and provide the necessary link between quality management at firm and engagement level. To this end, the element ‘Leadership responsibilities for quality within the firm’included in extant ISQC 1 has been adapted to ‘Governance and leadership’ and included in ED-ISQM 1.
Governance and leadership and the related responsibilities and accountability are pivotal to enhancing the robustness of a firm’s system of quality management. In revising the standards, the IAASB recognised the significant role that leadership play in the performance of quality engagements, in that they serve as the foundation to the firm’s culture and ethics and provide the framework to firm decisions and how these are made. As such, governance and leadership has been placed at the forefront of ED-ISQM 1. The requirements specific to governance and leadership have been significantly enhanced. Extant ISQC 1 includes two paragraphs under the leadership responsibilities, which in short require the firm to establish policies and procedures designed to promote an internal culture recognising that quality is essential to performing engagements and that any person assigned operational responsibility for the firm’s system of quality management have sufficient and appropriate experience and ability and the necessary authority to assume this responsibility. In comparison, ED-ISQM 1 includes six prescribed objectives and three prescribed responses that are more onerous on leadership. The public interest is best served by the consistent performance of quality engagements. It is clear that leadership is expected to proactively manage engagement quality to ensure that consistent quality is achieved.
The new and revised requirements are aimed at addressing the expectation of firm leadership to set the tone at the top. This includes demonstrating appropriate behaviour in carrying out the firm’s strategic actions and considering the related impact of engagement quality, which contributes to the firm’s role in protecting the public interest.
4. More rigorous monitoring of quality management systems and remediation of deficiencies
The IAASB recognised that continuous improvement is a key aspect of the quality management approach. This is achieved through timely monitoring of the system of quality management as a whole and the implementation of effective remediation to address issues identified. The monitoring and remediation process needs to be designed appropriately and operate effectively because without this, the firm would not be able to identify and remediate deficiencies.
To this end, there is an increased emphasis on monitoring the quality management system in ED-ISQM 1 to promote ongoing improvement and enhancements in ensuring that the system remains effective in managing quality.
The IAASB was cognisant that the nature, timing and extent of monitoring activities vary from firm to firm. As such, the new and revised requirements highlight factors that the firm would consider in designing the monitoring activities as opposed to prescribing the activities that need to be performed.
The auditing profession has seen a move towards understanding the underlying causal factors of inspection findings with the view of improving and enhancing audit quality. ED-ISQM 1 has followed suit by including a new requirement for firms to investigate the root cause of identified deficiencies.
In relation to ED-220, the monitoring and remediation requirements have also been enhanced, with the revised requirements being aligned to those proposed in ED-ISQM 1. The requirements of ED-ISQM 1 and ED-220 complement each other, in that that the engagement partner is responsible for dealing with relevant aspects of the firm’s monitoring and remediation process, including the results of monitoring and remediation process at firm level.
5. Enhanced responsibility of the engagement partner for audit engagement leadership and audit quality
In line with the expectation for the auditor to serve the public interest, the role and responsibilities of the engagement partner in managing and achieving quality were a topic of discussion at the IAASB. Sufficient and appropriate involvement of the engagement partner throughout the engagement is seen as fundamental to achieving the desired level of quality. Extant ISA 220 requires the engagement partner to take responsibility for the overall quality of each audit engagement and this has not changed. Rather, the role and responsibilities of the engagement partner have been clarified and the engagement partner’s responsibility for leadership and project management now being more explicit.
The requirements for the engagement partner to take overall responsibility for managing and achieving engagement quality have been expanded to include a stand-back provision. This provision requires the engagement partner to determine that his/her involvement has been sufficient and appropriate throughout the engagement and that the nature and circumstances of the engagement have sufficiently and appropriately been taken into account in complying with the ISA.
The ultimate question is whether the practical application of the new and revised requirements and related application material of ED-220 will result in improved and enhanced quality.
6. More robust engagement quality reviews, including engagement selection, documentation, and performance
The changes relating to engagement quality reviews re the most visible in that this has resulted in the drafting of a separate standard, namely ED-ISQM 2.
In relation to the interaction between the three proposed quality management standards, ED-ISQM 1 continues to include the requirements relating to engagements subject to an engagement quality review. ED-ISQM 2 addresses the requirements relating to the appointment and eligibility of the engagement quality reviewer, as well as the engagement quality reviewers’ responsibilities relating to the performance and documentation of an engagement quality review. ED-220 no longer contains any requirements regarding the performance of engagement quality reviews but addresses the requirements relating to the engagement partner’s responsibilities relating to the engagement quality review.
Questions about whether engagement quality reviews should be housed in a separate standard and whether the interaction between the three proposed quality management standards is appropriate are still being asked.
The proposed changes to quality management at both firm and engagement level are expected to significantly impact firms, with the new and revised requirements set to improve and enhance engagement quality. The standards are here to stay. I urge you not to wait and to start familiarising yourself with the requirements now so that when the standards do become effective, we are able to effectively and efficiently implement the new and revised requirements.
Hayley Barker Hoogwerf CA(SA), Project Director: Assurance at SAICA.
This article was originally published in the July 2019 issue of ASA.