ISQM 1 deals with the firm’s responsibility for quality through having a system of quality management. It replaces ISQC 1, the IAASB’s current International Standard on Quality Control, Quality Control for Firms that Perform Audits and Reviews of Financial Statements and Other Assurance and Related Services Engagements. Under ISQM 1, firms are required to design a system of quality management to manage the quality of engagements performed by the firm. This shift in focus from quality control to quality management is achieved by incorporating a risk-based approach, i.e., managing risks to quality.

ISQM 1 applies to all firms performing engagements under the IAASB’s standards. This includes audits or reviews of financial statements, other assurance engagements, compilations or agreed-upon procedures engagements.

ISQM 1 consists of eight components that operate in an iterative and integrated manner.

(a) The firm’s risk assessment process. Introduces a risk-based approach and requires firms to establish quality objectives, identify and assess quality risks and design and implement responses that address the quality risks. ISQM 1 includes the quality objectives that firms are required to have, which are incorporated in the other components described below (it should be noted that in some cases additional quality objectives may be needed). However, ISQM 1 does not include the quality risks, since firms are expected to identify the quality risks that exist given their nature and circumstances. Similarly, there are no responses in ISQM 1, other than a few specified responses, such as engagement quality reviews. As a result, firms are expected to design and implement their own responses.

(b) Governance and leadership. This creates the environment that supports the system of quality management. Aspects covered by this component include the firm’s commitment to quality through its culture, including reinforcing the firm’s role in serving the public interest by consistently performing quality engagements and addressing the importance of quality in the firm’s strategic decisions and actions. This component also covers the responsibilities and accountability of firm leadership for quality. Separate requirements in ISQM 1 deal with assigning leadership roles, the qualifications of the individuals assigned the roles and annual performance evaluations.

(c) Relevant ethical requirements. Requires establishing quality objectives that address the fulfillment of responsibilities in accordance with relevant ethical requirements, including those related to independence (e.g., The International Code of Ethics for Professional Accountants (Including International Independence Standards)). It also deals with others external to the firm, such as a network, network firms or service providers, and the need for the firm to address relevant ethical requirements related to the firm and the firm’s engagements that affect others external to the firm.

(d) Acceptance and continuance of client relationships and specific engagements. Requires establishing quality objectives that address judgments by the firm about whether to accept or continue a client relationship or specific engagement. This includes that the financial (e.g., fees and firm profit) or operational (e.g. growth or strategic direction) priorities of the firm do not lead to inappropriate judgments about whether to accept or continue a client relationship or specific engagement.

(e) Engagement performance. Requires establishing quality objectives that address the performance of quality engagements. It covers the responsibilities of the engagement team and engagement partner (including with respect to exercising professional judgment and professional skepticism), direction, supervision and review, consultation, differences of opinion, and the assembly and maintenance of engagement documentation.

(f) Resources. Requires establishing quality objectives that address appropriately obtaining, developing, using, maintaining, allocating and assigning resources in a timely manner. It covers human resources (personnel and people outside the firm who are used by the firm, such as EQR or component auditors), technological resources (e.g., IT applications, audit tools) and intellectual resources (e.g., the firm’s methodology, guidance, templates, written policies or procedures) needed to operate the system of quality management and perform engagements.

It also addresses the firm’s responsibilities when it belongs to a network, and the firm complies with network requirements or uses network services in the system of quality management or in the performance of engagements, as well as the use of resources from service providers and ensuring those resources are appropriate for what they will be used for. ISQM 1 focuses on reinforcing the firm’s responsibility for its own system of quality management.

(g) Information and communication. Requires establishing quality objectives that address obtaining, generating or using information regarding the system of quality management and communicating information within the firm and to external parties on a timely basis. It emphasizes the continual flow of information within the firm, and with engagement teams and reinforces the need for robust two-way communication throughout the firm. It drives firms to establish an information system with processes to identify, capture and maintain information and addresses the need for firms to communicate externally.

(h) The monitoring and remediation process. Requires the firm to monitor the system as a whole to provide relevant, reliable and timely information about the design, implementation and operation of the system of quality management (a shift in focus from engagement-level monitoring). Monitoring activities are intended to be tailored by the firm, and are required to include inspection of completed engagements (engagement partners are still required to be selected on a cyclical basis). A new framework has been introduced for evaluating findings and identifying deficiencies, as well as evaluating the severity and pervasiveness of deficiencies, which includes investigating the root cause(s) of deficiencies. There are also enhanced requirements addressing the remediation of deficiencies.

In applying a risk-based approach, the firm is required to take into account the nature and circumstances of the firm and its engagements and exercise professional judgment in designing, implementing and operating the system of quality management. For example, the information system in a less complex firm may not need to include rigorous policies and procedures that specify how information should be identified, captured, processed and maintained because there is more direct involvement of leadership and fewer personnel. In addition, in a less complex firm ultimate responsibility and accountability for the system of quality management may be assigned to a single managing partner with sole responsibility for the oversight of the firm.

One of the specified responses in ISQM 1 is a requirement for the firm to establish policies or procedures for engagements requiring an engagement quality review (EQR). The requirements have been enhanced from extant ISQC 1 by increasing the focus on selecting engagements based on quality risks. The application material provides guidance on the types of engagements, or qualities of engagements, that may give rise to quality risks where an EQR is an appropriate response to address that risk. For example, the firm can determine that an EQR is an appropriate response to quality risks associated with engagements where there is a high level of complexity or judgment or where issues have been encountered, or entities with public interest or public accountability characteristics.

ISQM 2 deals with the eligibility of the engagement quality reviewer, and the performance and documentation of the EQR. ISQM 2 is a new standard, although many of its elements were enhanced and relocated from extant ISQC 1 and ISA 220. Key enhancements include a 2-year cooling-off period before an engagement partner can assume the role of engagement quality reviewer, performance of the EQR at appropriate points in time during the engagement and a “stand-back” requirement to determine whether the performance requirements in ISQM 2 have been fulfilled.

It is, of course, possible that the firm may determine that there are no engagements for which an EQR is an appropriate response to address quality risks, in which case ISQM 2 would not apply.

ISA 220 (Revised) applies to audits of financial statements and addresses how quality is managed at the audit engagement level by the engagement partner. It makes clear that the engagement partner is responsible for managing and achieving quality at the engagement level, for determining that there are sufficient and appropriate resources assigned or made available on a timely basis and for determining the nature, timing and extent of direction, supervision and review. It also contains a “stand-back” provision that requires the engagement partner to determine they have done enough to take overall responsibility for managing and achieving quality on the audit and whether their involvement has been sufficient and appropriate.

These standards are a substantial development and change for the global accountancy profession and stakeholders around the world since they include significant shifts in how firms manage quality. As firms adjust their internal processes and systems, professional accountancy organizations (PAOs) will also need to adjust their training and support, as their members will need guidance to effectively and efficiently implement the new standards (see previous article, ‘New Quality Management Standards: A Tremendous Opportunity for PAOs’).

The IAASB has produced a range of useful materials, including:

• Introductory videos with overviews of each standard available in English, French, Mandarin, and Spanish
• Bases for Conclusions and factsheets for each standard.
• An overview article by IAASB Chair Tom Seidenstein.

These materials are available on the IAASB website, which will include the forthcoming first-time implementation guides, additional videos and frequently asked questions when available.

In addition, IFAC is exploring opportunities to raise awareness and understanding of the new standards, including sharing and developing additional resources to help practitioners. Stay tuned this year for additional information. Numerous additional guidance and support resources are also available in the Supporting International Standards section of the IFAC Knowledge Gateway.

If you have tips, recommendations, or good practice examples for how your firm is planning to implement the new quality managements standards, we would be delighted to hear from you in the comment box below. We also ask that you respond to our short survey below, which will help us plan and develop content to help you implement the new quality management standards.

The IAASB, which is an independent standard-setting board from IFAC, has published an implementation plan outlining what additional resources it will publish in 2021. The survey questions below are to help inform the efforts that IFAC may undertake.