Get Proactive with the ISQM 1 and Ten Top Tips for Audit Firms by John McCarthy
and Ten Top Tips for Audit Firms
It’s never too late to meet the deadline and our message is: don’t despair. There is still time to get ready, although it’ll mean setting aside dedicated Audit Partner and senior audit staff time to achieve this. Regulators will be looking for clear evidence of progress by the end of 2022 and certainly by this time in 2023 when firm’s compliance with the standard will come under intense scrutiny.
In this article we will look at:
what are the Top Ten Tips to help you get ready for implementation day and we also look at the Key Differences between this standard and its predecessor the ISQC 1, (International Standard on Quality Management) 1.
We’d recommend you also get hold of the IAASM Implementation Guide, which is genuinely helpful – although be warned; this is for the international version of the ISQM and doesn’t include the additional quality responses added to the Irish standard by the Irish Audit & Accounting Supervisory Authority (IAASA).
Assess your current approach to audit quality.
Firms aren’t (usually!) starting from scratch on audit quality and will have various policies and procedures already in place. While we want to stress that you shouldn’t simply ‘bolt on’ ISQM to your existing approach, it’s helpful to get a clear insight into what’s happening now (e.g., by taking a look with a critical eye at your existing ISQC 1 but being careful not to copy and paste the answers, but what’s in the ISQC1 may be helpful).
This may mean gathering various documents (like staff appraisals, CPD plans and IES 8), clarifying existing arrangements with the rest of the team and organising your thoughts.
Find out what your team thinks about your current approach.
Chances are, you and your team already have sound insights into what’s working well and what isn’t, and some honest feedback may be painful but is essential to making progress.
John McCarthy Consulting Ltd. (working in conjunction with our colleagues in Apex Professional Consulting Ltd.) has produced the ISQM TOOLKIT for the Republic of Ireland. It comes with a team questionnaire that can help you to gather anonymous feedback including suggestions for tackling problem areas.
For most if not all small firms, a critical success factor for ISQM compliance is the degree of support from partners, especially managing partners within firms.
Whether your firm is a sole practitioner or a larger firm, ISQM 1 challenges senior leadership to demonstrate genuine commitment to audit quality, recognising that this may not always align with a firm’s commercial strategy or its leaders’ priorities. You need to identify and deal with those conflicts, if present. You’ll also need to consider how much of the SOQM can be delegated to others and how the firm’s leadership will demonstrate that they bear ultimate responsibility for its success.
Don’t dismiss the appointment stage.
Many firms assign consideration of (re)appointment to junior audit staff who lack the judgement to assess ethical threats and to apply the right safeguards. Accepting a client relationship or engagement inappropriately removes any chance to achieve a quality audit.
Be honest about priorities.
Many firms say that they’re committed to audit quality, but a cursory scrutiny about how much of the firm’s time and money is spent in supporting and developing high quality audit may suggest otherwise. ISQM 1 demands that firms allocate enough resource to recruit and develop audit teams, supply them with appropriate tools (including hardware and software) and allow them the time to conduct audits thoroughly. You’ll also need to assess the quality risks of over-relying on external training providers, file reviewers or providers of methodology or IT tools.
Refocus on prevention rather than cure.
In the past, many audit firms have relied on regular cold file reviews to ensure their quality is up to scratch. Whilst such reviews will still play a key role, firms need to consider how to avoid audit defects altogether. For many audit partners, this may mean reducing the amount of time spent in review, and increasing the time spent in directing and supervising audits whilst in progress. Better prepared and managed teams should produce better audit files that need less review and remediation.
Plan your monitoring as you go.
As you set out your SOQM, make sure that every element is traceable and assign responsibility for monitoring to specific individuals, with clear instructions about how they should check progress and how they must record this. This should make the ‘monitoring and remediation’ part of the process much less burdensome. Don’t leave it all until the end!
Get familiar with Root Cause Analysis (‘RCA’).
This is a tool that has increased in profile of late, and while RCA can be sophisticated, it needn’t always be so. The aim is to identify systemic defects that, if corrected, will prevent problems from recurring. Don’t be afraid of asking ‘why did X happen’ multiple times when a quality problem is spotted, until the roots are uncovered.
Consider external support.
Whilst it’s possible to implement ISQM 1 without any other support, especially if you use a good transition tool, you may find that getting the assistance of a specialist can be hugely valuable, even if just as a sounding board.
One of the main differences is that ISQC was ‘passive’ (it could sit on the shelf for years without really affecting how the audit work was performed) while the ISQM 1 is much more ‘proactive’ requiring more thought and tailoring in its preparation leading to corrective action like root cause analysis (RCA). More on this in a later blog.
The other key differences are that the ISQM 1:
Requires the firm to take a risk-based approach to designing, implementing and operating the individual components of the system of quality management (called the SoQM). In this risk-based approach firms must:
- establish quality objectives;
- identify and assess the risks (the quality risks) that the quality objectives referred to above might not be achieved;
- design and implement responses to address the quality risks; and
- test and adjust the SoQM on a regular basis (probably annually) to ensure it is always fit for purpose.
The new ISQM 1 has eight components of a quality management system compared to six in the previous ISQC. The two new elements are the firm’s risk assessment process, and information and communication.
The standard includes enhanced requirements related to the firm’s commitment to quality through its culture.
Greater emphasis is placed on accountability for the system of quality management much more than was the case with the old ISQC.
There is a much more focused approach to the relevant ethical requirements rather than just independence which was emphasised in ISQC.
Resources are given more attention, so each audit firm must consider resources such as Human, Technological, Intellectual and Service providers.
Communication and information is one of the new components of the quality management system which places more emphasis on communications with external parties.
There is a new approach to the monitoring process requiring a specific technique called root cause analysis.
Requirements about engagement quality control reviews (EQCR) or hot file reviews are set out in a new standard, called ISQM 2. The old ISQC dealt with these in the past.
There is new requirement to understand quality in relation to resources, services and monitoring provided by a firm’s network, where relevant.
Many file reviewers are offering ISQM implementation help at the moment – why not ask your existing reviewer if they can help in this way?
If you need assistance with implementation, or have any questions please call John at 086 839 8360 or e-mail john@jmcc.ie.
www.jmcc.ie