ISA 220, engagement partner responsibility and risk before acceptance

A firm’s quality system only works if it is applied on each audit. That is the job of the engagement partner, who carries overall responsibility for the quality of the audit. The partner also decides, before the audit begins, whether the client is worth the risk, and what to do about the risks that are accepted.

Finally, the audit team needs methods and tools that make the work consistent and efficient.

This topic covers International Standard on Auditing (ISA) 220 and the engagement partner’s duties, the engagement quality control reviewer, the factors that decide the nature, scope and extent of an engagement, the risks to weigh before accepting an engagement, the risk management practices that respond to them, and the quantitative methods and automated tools used on audits.

These points were examined in May 2026: the partner’s responsibilities (4 marks), risk management after acceptance (6 marks) and quantitative methods and automated tools (9 marks).

ISA 220 and the engagement partner

The objective of the auditor under ISA 220 is to apply quality control at engagement level, so as to give reasonable assurance that:

1. the audit complies with professional standards and applicable legal and regulatory requirements; and
2. the audit report issued is appropriate.

ISA 220 puts responsibility for key quality matters on the engagement partner. The partner is responsible for the overall quality of the audit and must put procedures in place so that:

• Ethics: ethical standards are met and action is taken if there is evidence to the contrary;
• Independence: requirements are met, by identifying circumstances and relationships that threaten independence, assessing the impact of breaches of the firm’s policies, and taking action to remove threats or withdraw if appropriate;
• Acceptance and continuance: procedures cover new and continuing engagements;
• Team: the audit is carried out by a team with appropriate competence and capabilities;
• Management of the engagement: direction, supervision and review of work. On or before the date of the audit report, the partner must, through review of documentation and discussion with the team, be satisfied that sufficient appropriate evidence supports the conclusions;
• Consultation: adequate consultation on difficult or contentious matters, with the conclusions implemented;
• Monitoring: an appropriate monitoring system is in place; and
• Documentation: ethics issues and how they were resolved; independence conclusions; conclusions on new and continuing engagements; the nature, scope and conclusions of consultations; discussion of significant matters with the partner; review of the financial statements and proposed report; review of selected documentation on significant judgements; and an evaluation of the conclusions and whether the proposed report is appropriate.

The engagement quality control reviewer

The reviewer considers the team’s evaluation of the firm’s independence, whether appropriate consultation took place on difficult or contentious matters, and whether the selected documentation reflects the work performed and the conclusions reached.

The reviewer must document confirmation that the firm’s engagement quality control reviewer (EQCR) procedures were followed, that the review was completed on or before the date of the audit report, and that he knows of no unresolved matter that would make him believe that the significant judgements and conclusions were inappropriate.

The partner’s responsibilities under the revised standard

The syllabus lists the changes to ISA 220 on the partner’s role. The engagement partner should:

• consider all sensitive information gathered during acceptance and continuance when planning and carrying out the audit;
• be responsible for overall direction, supervision and review, and set and make sure the nature, timing and extent of work is followed;
• make sure the team and any specialists are competent and capable, allow enough time for the work and ask the firm for more people if resources are insufficient or inappropriate;
• delegate so that more experienced people direct, supervise and review less experienced team members, but keep overall responsibility and monitor the management of the audit;
• be accountable for the engagement and for compliance with ISA 220;
• make sure all working papers, the financial statements, the auditor’s report, the management letter and the report to those charged with governance or regulators are reviewed, and that there is sufficient appropriate evidence;
• lead remediation of a file if there is an issue with the work, and know what the monitoring and remediation process needs;
• show his involvement through progress meetings with the team, specialists and client, so significant and judgemental matters are resolved, and periodic site visits to resolve key audit issues; and
• work closely with the engagement quality reviewer if one is appointed, scheduling meetings and making sure the points raised are dealt with.

What decides the nature, scope and extent of an engagement

The auditor must plan an engagement that meets the needs of users of the financial statements. The issues to consider are:

Risk to consider before accepting an engagement

Before accepting, the firm must consider whether there are threats to compliance with the fundamental principles and understand the conditions, events and actions that may harm a quality engagement. It should design and carry out risk management strategies. The main considerations are:

1. Understanding the client and business: the engagement and its structure, the industry, the regulatory framework, and whether management knows and accepts its responsibility.
2. Integrity and reputation: background checks on those charged with governance and the company’s litigation history, through internet and media searches, and related party relationships or transactions that could harm the firm’s image.
3. Financial instability: the credit status, going concern issues, significant breaches of law or loan covenants, money laundering or other crime.
4. Nature of operations: structure, complex transactions, risky operations, a highly regulated public interest entity or a group with complex activity, and the political climate for a public sector client.
5. Financial reporting and the control environment: a history of creative accounting, wrong interpretation of standards or laws (such as tax), and poor bookkeeping.
6. Resources: competent people and specialists, and the firm’s tools against the client’s information technology (IT) environment.
7. Independence and conflicts: business relationships of any member firm or partner with the client, and whether the fee will compromise quality.
8. Change of auditor: do not accept if the firm is not satisfied with the reason for the change, the client refuses permission to talk to the previous auditor, or the previous auditor gives a valid reason not to accept.

Responding to the risks identified

Having found risks during acceptance, the firm can reduce them to an acceptable level through risk management practices such as:

1. where permitted, risk provisions such as dispute resolution and indemnification in the engagement letter;
2. assigning a more experienced team member;
3. further procedures to get to know the client;
4. assigning an engagement quality reviewer or other reviewer;
5. reviewing the engagement letter with the client, discussing its responsibilities and the firm’s expectations;
6. more frequent continuance evaluations, to make sure risk stays within what was first accepted; and
7. getting the client’s tax clearance certificate where applicable.

If the predecessor firm resigned or withdrew, for example because of association or reputation risk, the successor faces special challenges. In responding, it may consider whether the driver of the risk is continuing or being dealt with by the client, steps the predecessor took in the prior year’s audit, and the effect of other practices the firm has put in place.

Quantitative methods and automated tools

• Audit checklists: extracts of compliance items from standards, regulations or laws, such as working paper, International Financial Reporting Standards (IFRS) disclosure, Companies and Allied Matters Act 2020 (CAMA 2020) and Financial Reporting Council of Nigeria (FRC) checklists.
• Questionnaires for management and those charged with governance, which show strengths and weaknesses, for example on fraud, going concern or subsequent events.
• Interviews with process owners to understand the business, business processes and internal controls.
• Benchmarking the client’s processes against best practice, peers or international standards, for example a review of internal audit.
• Peer review: objective outside information that can bring innovation and better compliance.
• Review of working papers: to make sure enough appropriate evidence is gathered, and the work is done to plan and standards.
• Software and audit tools for data analysis, risk assessment, quick reporting and efficiency, which make activity easier to monitor.
• Audit programmes and templates: standard instructions for each audit area, which help document enough appropriate evidence and give quality working paper files.

The quantitative side, covered in later topics, includes analytical procedures, ratios and trend analysis, materiality calculations and statistical sampling.

Quantitative methods and automated techniques in more detail

An exam question that asks for “quantitative methods, automated tools and techniques” expects two groups, each tied to the client’s facts. The text covers CAATs, data analytics and sampling in later topics. The headings below are the ones the examiners have rewarded.

Background: The regression, machine learning and document management items come from the November 2025 and May 2026 model solutions and general audit practice. They fit the syllabus’s statements on data analytics and computer-assisted techniques in the later topics on computers in auditing and on IT in audit.

The rules in more depth

Why the partner has overall responsibility

Delegation is necessary, but accountability cannot be delegated. If quality failed, the partner signed the report. This is why ISA 220 requires the partner to be satisfied before the report date by reviewing documentation and talking to the team, and why the standard stresses involvement that can be shown: progress meetings and visits.

Why risk is assessed before acceptance, not only during the audit

Some risks cannot be fixed by more work during the audit. A client with dishonest management cannot be audited safely however many tests are done. Deciding at acceptance is cheaper than discovering the problem at the year end. The responses listed are ways to bring a borderline client within acceptable risk, and continuance reviews check it stays there.

Why tools matter

Checklists, programmes and templates make work consistent across teams. Software handles large volumes of data. Peer review and benchmarking give outside views. Together they raise quality, but they do not replace judgement.

Worked example: risks and responses at acceptance

1. Change of auditor. The previous auditor resigned after a disagreement. Contact the predecessor with the client’s permission and do not accept if the reason is not convincing or permission is refused.
2. Integrity and reputation. The tax dispute calls for background checks on the managing director and the litigation history.
3. Reporting history and controls. The change in accounting for leases that alters prior balances points to complex accounting and perhaps weak understanding of standards. Manual bookkeeping is a control weakness.
4. Related parties. Large director current accounts are related party balances that need scrutiny.
5. Responses. Include dispute resolution and indemnity terms in the engagement letter; assign an experienced manager with real estate and IFRS 16 knowledge, or a specialist; assign an engagement quality reviewer; review the engagement letter with the board on responsibilities; get the tax clearance certificate; increase the frequency of continuance reviews.
6. Tools. Use an IFRS disclosure checklist, a questionnaire on going concern and fraud, interviews with process owners, data analysis software on the manual ledger, and a standard audit programme.
7. Conclusion. Accept only if the predecessor’s answer and background checks are satisfactory, and then only with the responses above. Record the decision.

How to score full marks

• For the partner’s responsibilities, use heads. Ethics and independence; acceptance; competent team and resources; direction, supervision and review; consultation; documentation; evidence before the report date; working with the reviewer. For 4 marks, give four heads with a phrase each.
• For risk before acceptance, tie each risk to a fact. Name the risk, say why it matters, and say how to check it.
• For responses, give practices, not just risks. Examiners ask what the firm will do. Use the seven practices and add the predecessor’s steps if one resigned.
• For tools, give at least as many tools as marks, with a use for each. A 9-mark requirement needs nine tools or uses. Say what each does for the audit, and give a named example, such as an IFRS disclosure checklist.
• Link back to International Standard on Quality Management (ISQM) 1. Say which component a point comes from.
• Time. Spend time in proportion to marks.

Common mistakes in the exam

• Listing risks without responses, or responses without risks.
• Forgetting the engagement quality reviewer as a response.
• Giving only three or four tools in a 9-mark requirement.
• Saying the engagement partner delegates responsibility. He delegates tasks, not accountability.
• Forgetting that the partner must be satisfied on or before the date of the report.
• Accepting a client when the previous auditor has not been contacted, or when permission has been refused.
• Ignoring continuance evaluations after acceptance.
• Describing tools without saying how they improve quality.

Quick revision

• ISA 220 objective: reasonable assurance that the audit complies with standards and law and the report is appropriate.
• Partner: ethics, independence, acceptance, team, direction and review, consultation, monitoring, documentation, evidence before the report date, time and resources, remediation, work with the reviewer.
• Nature and scope: risk, objectives, users, resources, materiality, standards, previous findings.
• Acceptance risks: client and business, integrity, financial instability, operations, reporting and controls, resources, independence, change of auditor.
• Responses: engagement letter terms, experienced team member, more client enquiries, EQCR, discuss responsibilities, frequent continuance review, tax clearance.
• Tools: checklists, questionnaires, interviews, benchmarking, peer review, working paper review, software, programmes and templates.

Practice questions

These are original questions written in the style of the Institute of Chartered Accountants of Nigeria (ICAN) exam. Try each one before you open the answer. Full model answers follow the written questions.

Recall check: multiple choice

The real ICAN paper has no multiple-choice section. These questions are for quick recall. The written questions that follow are closer to the exam.

Written questions

Model answers

Spotted a mistake? Tell us and we will check it.