Firms that choose to engage with training providers now have access to a wide range of toolkits, templates and guidance. These take a variety of approaches, with different levels of detail in templates and questionnaires. All these options will require careful thought and investment of time by those responsible for audit within the firm. Firms should select an option that they are comfortable to use or may alternatively take their own bespoke approach. There is guidance available to all firms on the ICAEW Quality Management Hub
The QAD has no pre-determined view on how a firm should approach ISQM1 or precise detail of documentation. From 15 December 2022, we will want all firms to be able to:
- show us the key matters identified in their risk assessment with reference to the nature of the firm, it’s audit partners, staff and audit clients; and
- explain what impact these have on quality objectives and how these are addressed in the firm’s responses to those quality objectives.
Tailored risk assessment is key to the SoQM. Quality risks will differ substantially between a sole practitioner with few staff, and a 4-5 partner firm with 20-30 audit staff. Equally, an assessment of the quality risks from a stable audit portfolio of small and medium sized corporates will quickly change if the firm then takes on its first group audit, a large corporate or specialist audits such as charities, academies and pension schemes.
We know that the smallest audit firms with few clients are particularly concerned about QAD expectations. On the positive side, development of the SoQM for these firms will certainly be much easier compared to a larger and more complex firm. However, firms of two or three principals, and particularly sole practitioners will need to ask themselves some potentially difficult questions about their firm and the position of audit within the firm.
- How do we ensure that we keep up to date with changing auditing and ethical standards, and simply maintain our core audit competence when acting for just 1 or 2 audit clients?
- How do we devote sufficient time and resources to high quality audit work, when fees are just 10%, 5% (or less) of total firm revenue/activity?
Of course, larger firms may also have some important questions to ask themselves such as…
- The senior partner has retained responsible individual (RI) status but has not signed an audit report for three years, how do we ensure that individual maintains sufficient audit CPD, and what procedures would we need to put in place if they took on an audit now?
These are the types of discussion that QAD reviewers regularly have with firms. The potential impacts on quality objectives can be addressed with appropriate responses to mitigate the risks. Many firms will already have procedures including second RI reviews and regular engagement with training organisations for hot or cold file reviews. Some firms won’t, and this is why the effort involved in preparing for ISQM1 will vary so much between individual firms.
Finally, we know that some of our audit firms retain audit registration, but do not have any audit work that falls within audit regulations (no regulated audits, including no audits of small UK companies that choose not to take audit exemption). We appreciate that for this sort of firm, the lack of audit activity means that ISQM1 will have little practical impact on their basic existing audit whole-firm procedures. We expect these firms to at least be familiar with the ISQM1 requirements and ensure that they understand the additional work that they will need to undertake if they want to accept appointment to a regulated audit client in the future.
Remember that 15 December 2022 is just the start of a new era in audit quality management. Although current focus is all about preparation of the SoQM, the most critical aspect of ISQM1 is the operation of the SoQM in the months and years ahead, ensuring that quality risks and responses are kept up to date and the system – however simple or complex – becomes an integral part of being a registered auditor.
In December 2022, a sample of audit firms will be contacted by the QAD to find out more about their ISQM1 implementation and we will share the results, insights and emerging good practice with all audit firms in 2023.
QAD audit monitoring visits will also evolve from 2023, to ensure that any significant matters identified are addressed in the firm’s monitoring and remediation processes within its SoQM.