by John McCarthy Consulting Ltd. | Oct 10, 2022 | Blog, News
Continuing our blog where we looked at how to establish quality objectives for the ISQM, this week we look at how to assess the quality risks.
Have you assessed your quality risks yet?
The first step is to consider the likelihood and significance of a particular risk crystallising.
Bear in mind that the quality management process is iterative, so you can adjust the assessment at any time if you think it has changed since it was last assessed, as long as you document your changes and the reasons for the change.
Develop and implement responses
There are broadly 6 mandatory responses set out in ISQM 1 (see paragraph 34 of ISQM 1) to which the IAAASA have added a further 12 of their own (see paragraph 34D-1 of ISQM 1). Paragraph 34D-2 adds some requirements for auditors of listed entities and Paragraph 34D-3 mentions adjusting the requirements for the scalability and complexity of the audit firm and the entities it audits.
On their own they will not be sufficient for full ISQM 1 compliance.
Many of the policies and procedures you already have in place on your ISQC1 may be appropriate but be careful not to take the attitude that this is a copy and paste exercise.
The responses identified need to link back to the quality risks already identified and the established quality objectives. Please don’t give in to the temptation to work backwards by starting with your policies and procedures and then doing the responses followed by the risk assessment.
Follow this sequence:
- Document the key information about your firm and engagements;
- Think about the quality objectives in the standard and the risks that could arise by not achieving those objectives; and
- Then look at your current procedures and policies to identify gaps.
Where you find that your existing ISQC 1 policy or procedure doesn’t fit any of the risks, you have identified, it has one of two main consequences either:
- The procedure isn’t needed or
- You have missed a risk that needs more attention in the new ISQM 1 System of Quality Management (SOQM).
Monitor and revisit
As you progress through the standard and you evaluate and monitor your System of Quality Management (SOQM), you may revisit and change objectives, risks and responses. If deficiencies are identified, you must perform root cause analysis, the outcome of which may then involve revising either your objectives, risks or responses.
You may have already been doing this by responding to cold and hot file review and inspection findings, but perhaps not being sufficiently proactive about correcting deficiencies and ensuring they are much less likely to recur.
If you haven’t, please don’t need to wait until 15 December 2022 to start – get started now.
It’s impossible to cover everything in this brief blog. For more assistance please see our new ISQM TOOLKIT or if you prefer to chat through the different audit risks and potential appropriate responses presented by this new standard, please call or e-mail John McCarthy FCA or e-mail him at john@jmcc.ie
Publications and AML webinar
- The ISQM TOOLKIT 2022 is available to purchase here.
- See our latest Anti-Money Laundering Policies Controls & Procedures Manual (March 2022) – View the Table of Contents click here.
- Also we have an updated AML webinar (March 2022) available here, which accompanies the AML Manual. It explains the current legal AML reporting position for accountancy firms and includes a quiz. Upon completion, you receive a CPD Certificate of attendance in your inbox.
- To ensure your letters of engagement and similar templates are up to date visit our site here where immediate downloads are available in Word format. A bulk discount is available for orders of five or more items if bought together.
by John McCarthy Consulting Ltd. | Oct 3, 2022 | Blog, News
Six of the eight components have mandatory quality objectives established in the International Standard on Quality Management (ISQM) 1 (see paragraphs 25-34 of ISQM 1). For assistance with implementing the ISQM see our ISQM TOOLKIT available for immediate download here. There is 20% off for simultaneous purchases of five items or more.
There are no mandatory objectives for the two remaining areas:
- risk assessment or
- monitoring and remediation.
Smaller firms may find that the quality objectives already included in ISQM 1 are sufficient for their needs, but some firms may need to establish other objectives or sub-objectives. Every firm must consider (and evidence they considered) whether they need additional objectives – it’s not safe just to assume you don’t need them.
Note that if a quality objective included in ISQM 1 is not relevant to your firm then you can ignore it.
The next step is to identify quality risks that threaten the achievement of those quality objectives:
- Consider
- the nature and circumstances;
- the conditions and events;
- the actions and inactions; and
- the type and nature of the client engagements.
- Much of a firm’s nature and circumstances is dictated by:
- the people working there;
- the environment within which it operates; and
- the types of client it serves.
All of the above variables may have an impact on the quality risks that are most relevant to the firm, and each firm will need to assess the significance/likelihood of those risks crystallising.
The emphasis will need to be on identifying quality risks rather than focusing on the consequences of a risk crystallising – e.g.
- not understanding the requirements of the Ethical Standard is a quality risk;
- rather than a breach of the Ethical Standard which would be a consequence of that quality risk
Watch out that where you identify a quality risk that doesn’t result from a quality objective in ISQM 1 then you will need to establish a new quality objective.
Next week we will look at assessing risks.
It’s impossible to cover everything in this brief blog. For more assistance please see our new ISQM TOOLKIT or if you prefer to chat through the different audit risks and potential appropriate responses presented by this new standard, please call or e-mail John McCarthy FCA or e-mail him at john@jmcc.ie
Publications and AML webinar
- The ISQM TOOLKIT 2022 is available to purchase here.
- See our latest Anti-Money Laundering Policies Controls & Procedures Manual (March 2022) – View the Table of Contents click here.
- Also we have an updated AML webinar (March 2022) available here, which accompanies the AML Manual. It explains the current legal AML reporting position for accountancy firms and includes a quiz. Upon completion, you receive a CPD Certificate of attendance in your inbox.
- To ensure your letters of engagement and similar templates are up to date visit our site here where immediate downloads are available in Word format. A bulk discount is available for orders of five or more items if bought together.
by John McCarthy Consulting Ltd. | Sep 27, 2022 | Blog, News
The International Standard on Quality Management (ISQM) 1 requires firms to record quality objectives in six key areas. these are:
- Governance and leadership;
- Relevant ethical requirements;
- Acceptance and continuance of client relationships and specific engagements;
- Engagement performance;
- Resources; and
- Information and communication.
This week and in subsequent weeks, we will look at each of these primary objectives and explore some of their main requirements. Meantime our ISQM TOOLKIT has been published to guide you on the way.
The first of these areas is Governance and leadership. This is of paramount importance to quality management because it drives how the firm is perceived by its leadership, staff, audit clients and ultimately the public. Governance and leadership principles serve as the framework for how the firm’s decisions are made.
The standard has new and enhanced requirements regarding the firm’s commitment to quality through its culture.
The requirements now also focus on:
- The firm’s public interest role;
- The importance of professional ethics, values and attitudes;
- The responsibility of all personnel for quality relating to the performance of engagements or activities within the Statement of Quality Management (SOQM), and their expected behaviour; and
- Quality in the context of the firm’s strategic decisions and actions (e.g. will we expand the Tax Department and offer tax planning services to our private company audit clients), including the firm’s financial and operational priorities.
There are new requirements that:
- Address leadership’s behaviour and commitment to quality, and their accountability for quality;
- Address the organizational structure of the firm and the firm’s assignment of roles, responsibilities and authority; and
- address resource needs, and resource planning, allocation and assignment, which also include financial resources for matters like up to date software and training.
It’s impossible to cover everything in this brief blog. For more assistance please see our new ISQM TOOLKIT or if you prefer to chat through the different audit risks and potential appropriate responses presented by this new standard, please call or e-mail John McCarthy FCA or e-mail him at john@jmcc.ie
Publications and AML webinar
- The ISQM TOOLKIT 2022 is available to purchase here.
- See our latest Anti-Money Laundering Policies Controls & Procedures Manual (March 2022) – View the Table of Contents click here.
- Also we have an updated AML webinar (March 2022) available here, which accompanies the AML Manual. It explains the current legal AML reporting position for accountancy firms and includes a quiz. Upon completion, you receive a CPD Certificate of attendance in your inbox.
- To ensure your letters of engagement and similar templates are up to date visit our site here where immediate downloads are available in Word format. A bulk discount is available for orders of five or more items if bought together.
Tags: ISQM TOOLKIT, IAASA, International Standard on Quality Management (ISQM) 1, Root Cause Analysis, Anti Money Laundering Policies Controls & Procedures Manual, AML Training webinar.
by John McCarthy Consulting Ltd. | Sep 20, 2022 | Blog, News
Audit firms of all sizes, with differing levels of complexity will expect their service providers to publish an off the shelf manual to help implement ISQM 1, just like they did with its predecessor ISQC1. Our new ISQM TOOLKIT is here to help you with documenting your ISQM compliant audit quality risks and responses.
The new ISQM standard requires each audit firm to tailor the ISQM TOOLKIT in such a manner that the risks and responses are unique to each firm. In this regard the new ISQM TOOLKIT is very different to, its off the shelf predecessor, the ISQC1.
Each audit firm must document its:
- audit objectives (which will be unique, depending on the size of each firm and the nature, size and complexity of its client base),
- audit risks; and
- responses to those audit risks
because ISQM 1 requires that these responses are tailored to each firm’s particular circumstances. Each audit firm will need to consider the firm’s particular risks and ensure the responses are tailored appropriately, and document these with an annual review and updates in subsequent years. The process is iterative by its very nature.
The good news is that our new ISQM TOOLKIT has just been published to help audit firms implement the Action Plan below.
Action Plan
Here’s how to start.
- Write down key information about the firm and its audit engagements (e.g. do we audit any groups);
- Think about the quality objectives in the standard and
- The risks arising if those quality objectives are not met.
Then take a look at the firm’s current audit policies and procedures to identify gaps e.g. do we have up to date letters of engagement, representation, Financial Statement Disclosure Checklists or the latest audit manual for charities, insurance brokers etc.
If you find that you currently have an ISQC 1 policy or procedure that doesn’t fit any of the risks you have identified, either it isn’t needed or you have missed a risk. The answer will be unique to your firm and you will, need to decide which is the correct response. You can’t copy/past the answer from your friend down the road. It goes without saying that these blogs cannot be a substitute for reading the ISQM 1 itself.
More on documenting these risks in one of our upcoming blogs.
If you would like a bespoke consultation remotely or on-site to discuss the new ISQM 1 in more detail please send an e-mail to john@jmcc.ie
Future blogs
Over the coming weeks we will publish a series of blogs, alongside the publication of our new Audit Quality Control Manual called the ISQM TOOLKIT, to help auditors implement the new process.
Publications and AML webinar
- The ISQM TOOLKIT 2022 is available to purchase here.
- See our latest Anti-Money Laundering Policies Controls & Procedures Manual (March 2022) – View the Table of Contents click here.
- Also we have an updated AML webinar (March 2022) available here, which accompanies the AML Manual. It explains the current legal AML reporting position for accountancy firms and includes a quiz. Upon completion, you receive a CPD Certificate of attendance in your inbox.
- To ensure your letters of engagement and similar templates are up to date visit our site here where immediate downloads are available in Word format. A bulk discount is available for orders of five or more items if bought together.
Tags: ISQM TOOLKIT, IAASA, International Standard on Quality Management (ISQM) 1, Root Cause Analysis, Anti Money Laundering Policies Controls & Procedures Manual, AML Training webinar.
by John McCarthy Consulting Ltd. | Sep 19, 2022 | Blog, News
Around the globe, auditors are preparing for the imminent ISQM 1 regime, and it’s now just under three months to the deadline – 15 December 2022. On or before this date every Irish audit firm will need an ISQM-compliant System of Quality Management (‘SOQM’).
While larger firms have been working for many months to prepare for ISQM 1, we’re aware that many smaller firms are only just beginning the journey towards compliance and the last thing they might welcome is a reminder that time is running out!
Our new ISQM TOOLKIT is the answer to your needs and is available to purchase now for immediate download to help get you started. Click here for more details.
If you’re tempted to conclude that you’ve left it too late to meet the deadline, our message is: don’t despair. There is still opportunity to get ready, although it’ll mean setting aside dedicated partner time to achieve this, and regulators will be looking for clear evidence of progress by the end of the year and certainly by this time in 2023.
Here are our top ten tips to helping you get your SOQM across the finish line:
- Read the ISQM. There’s really no way around this! We’d recommend you also get hold of the IAASM Implementation Guide, which is genuinely helpful – although be warned; this is for the international version of the ISQM and doesn’t include the additional quality responses added to the Irish standard by the Irish Audit & Accounting Supervisory Authority (IAASA).
- Assess your current approach to audit quality. Firms aren’t (usually!) starting from scratch on audit quality and will have various policies and procedures already in place. While we want to stress that you shouldn’t simply ‘bolt on’ ISQM to your existing approach, it’s helpful to get a clear insight into what’s happening now (e.g., by taking a look with a critical eye at your existing ISQC 1 but being careful not to copy and paste the answers, but what’s in the ISQC1 may be helpful).This may mean gathering various documents (like staff appraisals, CPD plans and IES 8), clarifying existing arrangements with the rest of the team and organising your thoughts.
- Find out what your team thinks about your current approach. Chances are, you and your team already have sound insights into what’s working well and what isn’t, and some honest feedback may be painful but is essential to making progress.John McCarthy Consulting Ltd. (working in conjunction with our colleagues in Apex Professional Consulting Ltd.) has produced the ISQM TOOLKIT for the Republic of Ireland. It comes with a team questionnaire that can help you to gather anonymous feedback including suggestions for tackling problem areas.
- Start with leadership and governance issues. For most if not all small firms, a critical success factor for ISQM compliance is the degree of support from partners, especially managing partners within firms.Whether your firm is a sole practitioner or a larger firm, ISQM 1 challenges senior leadership to demonstrate genuine commitment to audit quality, recognising that this may not always align with a firm’s commercial strategy or its leaders’ priorities. You need to identify and deal with those conflicts, if present. You’ll also need to consider how much of the SOQM can be delegated to others and how the firm’s leadership will demonstrate that they bear ultimate responsibility for its success.
- Don’t dismiss the appointment stage. Many firms assign consideration of (re)appointment to junior audit staff who lack the judgement to assess ethical threats and to apply the right safeguards. Accepting a client relationship or engagement inappropriately removes any chance to achieve a quality audit.
- Be honest about priorities. Many firms say that they’re committed to audit quality, but a cursory scrutiny about how much of the firm’s time and money is spent in supporting and developing high quality audit may suggest otherwise.ISQM 1 demands that firms allocate enough resource to recruit and develop audit teams, supply them with appropriate tools (including hardware and software) and allow them the time to conduct audits thoroughly. You’ll also need to assess the quality risks of over-relying on external training providers, file reviewers or providers of methodology or IT tools.
- Refocus on prevention rather than cure. In the past, many audit firms have relied on regular cold file reviews to ensure their quality is up to scratch. Whilst such reviews will still play a key role, firms need to consider how to avoid audit defects altogether.For many audit partners, this may mean reducing the amount of time spent in review, and increasing the time spent in directing and supervising audits whilst in progress. Better prepared and managed teams should produce better audit files that need less review and remediation.
- Plan your monitoring as you go. As you set out your SOQM, make sure that every element is trackable and assign responsibility for monitoring to specific individuals, with clear instructions about how they should check progress and how they must record this. This should make the ‘monitoring and remediation’ part of the process much less burdensome.Don’t leave it all until the end!
- Get familiar with Root Cause Analysis (‘RCA’). This is a tool that has increased in profile of late, and while RCA can be sophisticated, it needn’t always be so. The aim is to identify systemic defects that, if corrected, will prevent problems from recurring. Don’t be afraid of asking ‘why did X happen’ multiple times when a quality problem is spotted, until the roots are uncovered.
- Consider external support. Whilst it’s possible to implement ISQM 1 without any other support, especially if you use a good transition tool (did we mention that John McCarthy Consulting Limited has designed the ISQM TOOLKIT with the smaller firm in mind?), you may find that getting the assistance of a specialist can be hugely valuable, even if just as a sounding board.
Many file reviewers are offering ISQM implementation help at the moment – why not ask your existing reviewer if they can help in this way?
If you need assistance with implementation, or have any questions please call John at 086 839 8360 or e-mail john@jmcc.ie.
The ISQM TOOLKIT is available here to purchase now for immediate download.
