This second article on quality management focuses on two specific areas. International Standard on Quality Management 2, Engagement Quality Reviews (‘ISQM 2’), and ISA 220 (Revised), Quality Management for an Audit of Financial Statements. Candidates are expected to have an understanding of the requirements of these two standards and may face discussion questions regarding the purpose and content of these standards. Candidates are also expected to be able to apply this knowledge to scenarios.
An engagement quality review (EQR) is an integral part of the audit process for many audits. An EQR is defined by the IAASB as an ‘objective evaluation of significant judgements made by the engagement team and the conclusions reached thereon, performed by the engagement quality reviewer (the reviewer) and completed on or before the date of the engagement report'.1
Candidates should note this is a very specific term and should avoid the use of ‘second partner review’, ‘concurring review’, ‘independent partner review’ or ‘hot review’ in the exam as these terms are subject to different interpretations and may not mean the same thing. Candidates should also be aware, when proposing an EQR, that they specify which engagement would be subject to such a review if the firm is providing more than one service.
ISQM 2 aims to ensure the right person is appointed to perform the review and clarifies the responsibilities associated with the role. It seeks to emphasise the importance of, and to improve the effectiveness of, EQRs.
ISQM 1 details the requirements when an engagement is subject to an EQR.
ISQM 1 requires firms conduct an EQR on audits of listed companies, audits and other engagements where an EQR is required by law or regulations and audits or other engagements for which the firm determines that an EQR is an appropriate response to address one or more quality risks. Examples of this include:
| Exam focus Candidates may be required to identify situations where an EQR should be performed either because it is required by legal or professional requirements or because it is an appropriate response to a situation or quality management risk arising in a scenario. |
To ensure the effectiveness of an EQR, it is important that the person performing the review is appropriate. ISQM 2 provides guidance on who is eligible to be appointed to this role:
| Exam focus Candidates may be required to demonstrate an understanding of why these criteria are in place either through discussion, or through application to a scenario, for example, recognising and explaining where an ineligible person has assigned the role of the reviewer or has been prevented from performing their role effectively. |
In order to enhance the robustness of the EQR process, ISQM 2 clarifies the responsibility of the reviewer. There is a requirement to perform procedures at different points in time during the engagement, so the reviewer may be involved during the planning stage as well as during the audit, rather than just at the completion stage.
The reviewer is required to review and understand the significant judgements made by the engagement team. They will assess whether the audit engagement documentation supports those judgements and whether the conclusions reached are appropriate. In doing so, the review will specifically evaluate whether the engagement team has exercised professional scepticism in reaching those conclusions.
The reviewer is also required to evaluate:
ISQM 2 also includes a ‘stand back’ requirement for the reviewer to determine whether all the requirements for the EQR have been met and whether the review is complete. An audit report cannot be dated before the reviewer determines the process is complete.
| Exam focus Understanding the full responsibilities of the reviewer will enable candidates to evaluate a scenario to determine whether an EQR has been performed as required and to identify where deficiencies in the process have occurred. |
ISQM 2 specifically requires the reviewer to be responsible for the documentation of the EQR which must be filed with the audit documentation. This must be sufficient to allow an experienced practitioner, having no previous connection to the engagement to understand the nature, timing and extent of the EQR procedures performed. Individual firms may have policies and procedures that go further than this as part of the System of Quality Management (SoQM) of the firm.
| Exam focus Candidates may be required to evaluate whether sufficient appropriate documentation exists within a scenario or recommend improvements to the firm’s SoQM to mitigate any weaknesses. |
The responsibility of the EQR process remains at the firm level and is part of the wider SoQM as stipulated by ISQM 1. This ensures the robustness of the EQR process leading to an improvement of audit quality by assessing audit team’s professional scepticism when making judgements and whether the audit evidence supports the final conclusions.
ISA220 (Revised) concerns the specific quality considerations for an audit of financial statements and, hence, has a more limited scope that ISQM 1 and ISQM 2 which are firm wide. Here the engagement team, lead by the audit engagement partner is responsible for the compliance with the standard as part of the firms SoQM. Specifically, they are responsible for:
The audit engagement team is required to plan and perform the audit with professional scepticism, whilst exercising professional judgment in order to ensure a quality audit is performed supporting the correct audit opinion. An audit should be performed in such a way to mitigate where there may be problems exercising appropriate professional scepticism – eg those arising through unconscious bias (for example, assuming the client is correct) or resource constraints. The audit partner is ultimately responsible for the quality of the specific audit which gives reasonable assurance that:
Two key areas where ISA220 (Revised) provides specific guidance over and above that in ISQM 1 are those relating to engagement resources and engagement performance. These topics are regularly examined in the context of scenarios in a quality management question. Whilst the full standard is examinable, candidates’ responses in these two specific areas are often poorly constructed or vague and hence a more detailed understanding of the requirements in this area will be valuable.
ISA220 (Revised) states that the audit engagement partner is responsible for ensuring sufficient and appropriate resources are available to the engagement team in a timely manner and in line with the firms policies and procedures. This includes changes to resources required as circumstances change during the audit. The partner is also responsible for ensuring the engagement team and any external expert and internal auditors providing direct assistance to the team have appropriate competence to perform their assigned roles.
| Exam focus Candidates may be required to evaluate quality management issues in a scenario and, are expected to be specific in their descriptions. See the example described below: Consider a situation where the audit supervisor was off work for health reasons and the audit engagement manager was too busy to help out the team performing the audit fieldwork. As a result, the audit juniors have been left to perform all the audit procedures on their own including the impairment of properties which were identified as high-risk during planning. A well explained evaluation might be as follows: ‘An audit junior has performed the audit of property impairments which contain a high level of judgement when assessing managements estimates. As this is an area identified as high risk at planning, and is subjective, the junior may not have the technical knowledge to audit this area and may have felt unable to challenge management sufficiently when auditing this area. In the absence of the audit supervisor or more senior staff, the junior will not have been able to consult on difficulties face whilst following the audit programme and there has been a lack of supervision which could mean any problems have not been picked up in a timely manner. Overall, these factors will increase the risk that insufficient or inappropriate evidence has been obtained in this area and a material misstatement may not be identified’ A weaker response might simply say: ‘Not enough resources were available. This is not a quality audit’ The first answer has specific points of development, the latter has simply identified the issue with no evaluation. This means the latter response achieves fewer technical marks for demonstrating an understanding of the issue and that it is not possible to assign analysis and evaluation marks. The first answer will be more likely to obtain professional skill marks for scepticism and judgement as they have demonstrated challenged the ability of the junior to perform the task sufficiently to provide audit evidence. Note that the first answer doesn’t just state that quality is poor, they explain why this is audit area may not be performed with sufficient quality. |
ISA220 (Revised) provides specific guidance on the performance of individual audits. The audit engagement partner is responsible for the direction and supervision of the engagement team’s work and the review of their work. In order to do this, the engagement partner must determine that the audit is planned and performed in accordance with the firm’s policies and procedures, professional standards and applicable legal and regulatory requirements, and also that changes can be made to the resources available to the team where circumstances change.
The audit partner is expected to review the audit documentation relating to significant matters and judgements, contentious issues and the conclusions reached. This is performed at appropriate stages during the audit. For example, the audit partner would be expected to review the determination of materiality for the audit which would likely be most appropriately reviewed at the planning stage of the audit. If circumstances change and materiality is reassessed, then the audit partner may be expected to review this during the audit itself. The audit partner must also ensure that sufficient appropriate evidence has been obtained to support the opinion in the auditor’s report before the audit report is issued.
In addition to these responsibilities on each and every audit, it is also required the partner takes responsibility for the audit team undertaking consultation on difficult and contentious matters. This consultation may be within the audit team, where a more junior member may seek guidance from more senior team members or it may be external to the team, either within the firm, for example with the firm’s own experts and specialists or external to the firm.
The audit engagement partner is also required to ensure an engagement quality reviewer is appointed where necessary and that the engagement team cooperate with the reviewer, including ensuring all significant matters and judgements arising with respect to the audit are discussed with the reviewer. The audit partner should not date the audit report until the EQR is complete and any differences of opinion are resolved.
| Exam focus Candidates are often required to evaluate quality deficiencies in an audit, sometimes pre-issuance of the audit report, sometimes post-issuance. The evaluation should refer to specific deficiencies and their implications rather than make broad comments that the audit was not properly supervised or reviewed. It would be expected that candidates identify the specific instance where review was omitted or when more supervision should have occurred and how that would have altered the outcome of events. Candidates should also note that without the analysis documented, it is not possible to credit a reasoned conclusion so simply stating ‘a quality audit was not performed’. Actions proposed by candidates in response to the quality management issues identified must be appropriate for the stage in the audit. A review identifying a lack of evidence prior to the issuance of the audit report can be mitigated by obtaining that evidence before signing the audit report, identifying a material misstatement at this stage can lead to a qualification of the audit report. However, where an audit report has already been issued, the option to qualify the audit report is not available, and other actions are required. |
The quality standards provide the fundamental framework for embedding quality into every audit and reducing audit failures, helping to identify where professional standards may not have been followed or an inappropriate audit report may have been issued. These standards firmly place the responsibility for audit quality at the firm level rather than the level of an individual audit partner and have been designed to be flexible and scalable whist permeating every part of every audit.
A focus on quality throughout the audit firm should lead to better audits and more accountability.
Candidates should expect quality management to permeate all areas of the exam and should familiarise themselves with the standards.
Further reading
Candidates should be familiar with the most recent quality standards which may be accessed from the IAASB webpage.
(1). International Standard on Quality Management 2: Engagement Quality Reviews, IAASB (www.iaasb.org)