Newsletter March 2021 – ISQM 1
Since the new quality management standards were issued in December 2020, they have been the topic of several communications on social media and other platforms. The main questions on everyone’s mind are: ‘What are the changes?’ ‘What do we need to do?’ and, ‘By when should it be done?’ This article attempts to address these burning questions to set your mind at ease.
Changes introduced by ISQM 1
The current International Standard on Quality Control (ISQC) 1, which addresses firms’ systems of quality control, is replaced by the International Standards on Quality Management (ISQM) 1. The most pertinent changes introduced by ISQM 1, compared to ISQC 1, are set out below.
ISQC 1 addresses six elements of quality control and documentation, while the new ISQM 1 is comprised of eight components that operate in an iterative and integrated manner. ISQM 1 also incorporates other requirements relating to roles and responsibilities of the system, leadership’s overall evaluation of the system, network requirements and documentation.
The current requirements of leadership have been expanded to provide more robust requirements of governance and leadership, among others, addressing:
- The firm’s demonstration of commitment to quality through its culture, which exists throughout the firm, including recognising and reinforcing:
- The firm’s role in serving the public interest by consistently performing quality engagements
- The importance of quality in the firm’s strategic decisions and actions, including those related to the firm’s financial and operational priorities
- The roles, responsibilities and accountability of leadership, and leadership’s qualifications, and undertaking annual performance evaluations of leadership.
ISQM 1 Introduces a risk-based approach focused on achieving quality objectives:
- ISQM 1 prescribes comprehensive, outcome-based quality objectives under each of the components of the system of quality management. Firms can establish additional quality objectives considered necessary to achieve the overall objectives of the system of quality management based on their circumstances.
- Based on the firm’s understanding of the conditions, events, circumstances, actions or inactions that could adversely affect the achievement of the quality objectives, ISQM 1 requires firms to identify and assess quality risks. Risk identification and assessment is performed by focusing on the nature and circumstances of the firm, and the engagements it performs.
- ISQM 1 requires firms to design and implement responses that address the quality risks. ISQM 1 prescribes some responses, but these are not comprehensive, and firms need to design their own responses based on the nature and circumstances of the firm, and its engagements.
If the nature and circumstances of the firm or its engagement change, or deficiencies are identified through the firm’s monitoring and remediation process, the firm needs to establish additional quality objectives as necessary, modify the risk quality risk assessment and adapt its responses to the quality risks.
The current requirements of human resources have been renamed ‘resources’, and have been expanded as follows:
- Three categories of resources are specified that are needed to operate the system of quality management and perform engagements: human, technological and intellectual resources.
- Resources from service providers are specifically addressed.
- Firms need to consider which resources are needed, whether they are appropriate, and how they are used and maintained.
ISQM 1 introduces a new component of quality management, called information and communication:
- The new standard emphasises the continual two-way flow of information within the firm and within engagement teams, and drives the firm to establish an information system.
- Firm culture needs to embed the need to exchange information to enable quality management.
- Firms need to communicate with external parties, when appropriate (transparency reporting), including communication with those charged with governance about the system when firms perform audits of financial statements of listed entities.
The current requirements regarding monitoring have been expanded to address monitoring and remediation to ensure proactive monitoring of the whole system, and timely and effective remediation:
- Firms must monitor the system as a whole, tailor the nature, timing and extent of monitoring activities based on specific factors, and perform risk-based inspection of completed engagements.
- ISQM 1 now includes a framework to assist with evaluating findings, identifying deficiencies, evaluating the severity and pervasiveness of deficiencies, and investigating root causes of deficiencies.
- Firms must appropriately remediate deficiencies responsive to root causes and leadership must determine that remedial actions are effective.
A new requirement introduced is that firms annually perform a formal evaluation of the system of quality management:
- Leadership need to evaluate and conclude whether the system of quality management is achieving its objectives.
- This evaluation must be performed at least annually.
- Firms must take further action, if the conclusion is unsatisfactory.
Lastly, ISQM 1 specifically addresses the use of networks:
- ISQM 1 reinforces the firm’s responsibility for its own system of quality management, irrespective of network requirements or services.
- Firms need to understand network requirements or network services and the effect on the firm’s system of quality management.
- Firms need to understand monitoring activities undertaken by the network, across network firms, including those determining whether network requirements have been appropriately implemented across network firms.
What firms need to do and by when
The effective date of ISQM 1 is 15 December 2022, which gives firms 24 months from the release date of the standards (December 2020) to set everything up.
Firms should update the design of their systems of quality management to ensure full compliance with ISQM 1. This would entail updating existing policies, procedures, processes, forms and templates. The system redesign must be completed by 15 December 2022.
Subsequently, firms need to test and implement their redesigned systems to ensure that they are fully operational by the effective date of the standard.
ISQM 1 further indicates that the first round of monitoring and evaluation of the system must be performed within one year from 15 December 2022. This means that monitoring reviews at file and firm level need to be performed throughout 2023, for the evaluation and conclusion on the effective operation of the system to be completed by 15 December 2023.
The IAASB will soon be issuing guidance materials to clarify this process and requirements in more detail.
In summary
It is important that you understand the key changes introduced by the new standards and how to implement them in time. The LEAF approach to implementation of quality standards at small to medium-sized practices already incorporates some of the new elements introduced, which facilitates transition and compliance with the new requirements. Contact LEAF for peace of mind!
References
1. IAASB: ISQM 1, Quality management for firms that perform audits or reviews of financial statements, or other assurance or related services engagements
2. IAASB: ISQC 1, Quality control for firms that perform audits and reviews of financial statements, and other assurance and related services engagements
Need help?
If you need advice, guidance, assistance or training, our experienced specialists at LEAF are ready to help your firm to push above and beyond the norm.