Quality management in firms: ISQM 1

An audit firm sells one thing above all: confidence that its work is sound. A single poor audit can bring damages, lost clients, bad publicity and discipline from Institute of Chartered Accountants of Nigeria (ICAN), and it can damage the whole profession. Quality management is the firm’s system for making sure every engagement meets the standard, whoever does the work and however big the team.

This topic covers why quality control is needed, the firm-level system under International Standard on Quality Management (ISQM) 1 and its components, the purposes and principles of quality management, the elements of a system relevant to a given firm, the forms of review (hot, cold, peer and engagement quality reviews), monitoring and remediation, documentation, and quality control in large and small firms.

The next topic covers quality at engagement level under International Standard on Auditing (ISA) 220. Examiners set these as 3, 5 and 6 mark requirements, as in May 2026 Question 1, so learn each list with its heads.

Why quality control is needed

The International Federation of Accountants (IFAC) and ICAN codes require members to work with due skill and care and technical competence. An audit is often done by a large team with different levels of knowledge and experience, so firms need a strong system of quality control. A good system lowers the risk that the firm will give an incorrect opinion and that it will be sued for negligence.

The consequences of poor work and legal action by a client may include damages and legal costs, loss of the client, bad publicity and damage to the firm’s reputation, and disciplinary proceedings by a body such as ICAN. The whole profession also suffers if audit firms in general become known for poor quality.

Quality control can be considered at two levels: the audit firm as a whole (ISQM 1) and each individual engagement (ISA 220, the next topic).

The firm’s objective and ISQM 1

ISQM 1 requires the firm to design and operate a robust system of quality management. A rigorous review is part of it. ISQM 2 gives requirements on appointing and qualifying the engagement quality reviewer, what the reviewer should do and the documentation expected.

The objective of the firm under ISQM 1 mirrors the auditor’s objective under ISA 220. It is to establish and maintain a system of quality control that gives reasonable assurance that:

1. the firm and its personnel comply with professional standards and applicable legal and regulatory requirements; and
2. the reports the firm issues are appropriate.

The procedures will reflect the nature and size of the practice. People responsible for setting up and maintaining them must understand the whole of ISQM 1. The standard expects a risk-based approach: the firm sets quality objectives, identifies and assesses risks, and designs and implements responses so that the risks are addressed.

The components of the system

Acceptance of a new audit client

When a firm accepts an audit from a new client, it should make sure that:

• it is independent and has no conflicts of interest;
• it has the technical competence to do the work;
• professional clearance has been obtained from the previous auditors;
• anti-money laundering (client identification) procedures are done;
• the fee is enough for the nature and circumstances without compromising quality;
• legal and regulatory requirements are met;
• the engagement will use the appropriate financial reporting framework, such as International Financial Reporting Standards (IFRS);
• management has accepted its responsibility for the financial statements and has suitable internal control; and
• all the information needed will be made available, with access to the people who provide evidence.

Before each year’s audit starts, the engagement partner should make sure that all team members are independent and free of conflicts, and be satisfied about the integrity of the client and its management.

Resources

The firm needs policies for recruiting, training and developing staff. Staff should know the ISAs, accounting standards and local statutory accounting rules. They need authority to apply the policies and should be paid well enough not to leave. Technical procedures should be in a manual reinforced by training, with newsletters or meetings to update staff.

Work should go to competent people. Each team should collectively have the technical knowledge for the engagement, with people who have experience of audits of similar complexity and the ability to apply professional judgement.

Principles and purposes of quality management

The core principle is that practitioners focus on the public interest, meaning the users of the financial statements or report, and keep professional scepticism at all times. The approach should be proactive, not mere compliance, and should reflect changes in technology and business. Monitoring and communication, inside and outside the firm, should be strengthened. The syllabus lists these principles:

1. Meet and exceed client expectations: be client-focused and work with clients as business partners.
2. Leadership that guides and motivates: invest in the growth of staff, with a collaborative mind.
3. Belonging and commitment: an environment that helps staff improve, gives career progression, recognises differences and rewards excellence.
4. A proactive organisation: all working towards stated goals for consistent results, with room for creativity and constant improvement.
5. Continuous improvement: root cause analysis of problems.
6. A robust database for decisions: reliable information as the basis of plans.
7. Good relationships with all stakeholders: aligned goals and open communication.

Purposes

• a road map for quality creates awareness of its value, increases revenue and reduces waste and cost;
• it helps compliance with standards, builds trust, consistency and transparency, and the firm’s image;
• it identifies areas needing improvement as business changes, so the firm responds proactively;
• it gives an objective evaluation of business processes and strong evidence that reports rest on thorough analysis, so clients take reports seriously and may refer others;
• when staff understand the process they are motivated, build team spirit and productivity and speed up learning, which can shorten turn-around time;
• early identification and management of problems reduces risk, prevents avoidable mistakes and customer dissatisfaction, and protects reputation; and
• robust quality leads to quality service delivery, which is a selling point against competitors.

Elements of a system relevant to a given firm

1. a definition of quality and a quality policy that is scalable and reflects the firm’s mission and values, so expectations run from top management to junior staff;
2. a quality manual that outlines the system, using flowcharts and tables rather than detail;
3. realistic, specific, attainable and measurable quality objectives aligned with the policy and open to review;
4. a clear organisational structure and responsibilities, with charts linked to standard operating procedures;
5. control of records and documentation, with changes approved, evaluated against risk and communicated, and old versions replaced;
6. defined, standardised processes with standards and success metrics, and a map showing how processes connect;
7. data analysis to identify failing processes early, using client feedback, corrective and preventive actions, non-conforming work, supplier performance and trends;
8. provision for continuous improvement through corrective and preventive action; and
9. a maintenance policy for equipment so that it meets standards, with procedures to check accuracy, set intervals, prevent tampering and protect it, and with records kept for review.

Direction, supervision and review

Quality control on an individual engagement rests on managing the audit team: directing and supervising staff and reviewing their work.

• Direction is the engagement partner’s responsibility. Team members are told the work expected and its objectives. There is a well-prepared work programme and staff know the overall plan. Members should understand their responsibilities, the client’s business, risk issues, likely problems and the detailed approach. They should stay objective and independent, work with due care and ask more experienced members when in doubt.
• Supervision continues throughout. It tracks progress, monitors competence (enough time, understanding of instructions, work in line with the plan), addresses significant issues and adjusts the approach, identifies when to consult more experienced people, and monitors the behaviour of junior staff to make sure they keep ethical standards.
• Review should cover all work, ideally by someone with more competence and experience than the person who did it.

The purpose of review is to check that the work met professional standards, the audit objectives were achieved, the work and evidence are documented and support the conclusions, and the financial statements comply with standards and law. Review covers planning, the procedures (working papers, tests and evidence, compliance with the programme, resolution of problems, and the financial statements), and whether the conclusion matches the evidence. The review itself is documented.

Before the report is issued, the engagement partner must be satisfied that sufficient appropriate evidence supports the conclusions. This partner’s review is scheduled towards the end of the audit, and a manager’s review normally comes first. Before the partner’s review, the senior should make sure every file is complete and cross-referenced.

Monitoring and remediation

The firm must have a monitoring process that gives reasonable assurance that the system is relevant, adequate and working effectively. It includes inspecting, on a cyclical basis, at least one completed engagement for each engagement partner. A partner or other person with enough experience and authority should be responsible. Cold reviews must not be done by people involved in the engagement or in its quality review.

When deficiencies are found the firm should evaluate whether they show a failing in the system and communicate them with remedial action. Remedial action may include action on individual engagements or staff, telling those responsible for training, changing the quality control system, and discipline, especially for repeat offenders.

If monitoring shows an inappropriate report may have been issued, or procedures were omitted, the firm decides on further action, which may include legal advice. Partners with practice review deficiencies on their files should be kept from supervising public interest entities and from acting as engagement quality reviewers on large engagements until the deficiency is fixed. The firm should do root cause analysis and take action.

It should produce an annual report to partners on the monitoring performed, conclusions and any systematic deficiencies and the fix. Procedures should cover complaints and allegations, with channels for employees to report without fear of reprisal.

Large firms and small firms

Large international firms offer local offices regional and national training, a comprehensive audit manual, a central technical department, in-house publications, standardised audit documentation and inter-office reviews. Small firms need quality control just as much, but cannot afford these. They may use reciprocal arrangements for review and consultation with other firms, manuals and standard documents from third parties or professional bodies, and external training courses.

Spotting weak quality in an audit

A question asking you to discuss the adequacy of audit and quality control usually expects you to find weaknesses such as:

• poor planning, for example failing to find key risks
• lack of independence of the firm or team
• weak quality of staff assigned
• poor evidence for sections of the audit
• complex work given to inexperienced staff
• inadequate direction, supervision and review by the manager and partner

Example. A junior information technology (IT) graduate advises the client on improving its IT systems during planning. This shows poor direction and supervision and weak training: findings on controls should go to a senior, who decides the action. The partner must find out what advice was given and whether it was used, since poor advice acted on could expose the firm to liability.

The rules in more depth

Why quality has to be a system

A firm cannot rely on every partner to be careful in the same way. A system turns good intentions into steps that can be checked: written policies, assigned owners, review before signing and monitoring after. This is why ISQM 1 starts with governance and leadership. If the managing partners do not care about quality, no policy will work.

Why review comes in two timings

A review before the report is signed can stop a bad opinion. A review afterwards cannot change that report but shows whether the system works and what to fix. Hot reviews and EQCRs are preventive. Cold reviews are detective. A firm needs both.

Why independence confirmations are annual

Relationships change as people buy shares, marry or move jobs. A yearly written confirmation from every member of staff forces a regular check and creates a record.

Worked example: a firm joining an international network

1. Objective. The firm needs a system that gives reasonable assurance that the firm and staff comply with standards and law and that reports are appropriate.
2. Components. The firm must show governance and leadership, a risk assessment with quality objectives, ethical requirements and annual independence confirmations, acceptance and continuance procedures, human resources, engagement performance, monitoring and remediation, information and communication, and documentation.
3. Reviews. The three listed clients require an engagement quality control review before the report is signed, by a qualified, objective reviewer (ISQM 2). Informal peer review is not enough.
4. Monitoring. The firm needs a cyclical programme that inspects at least one completed engagement for each of the eight engagement partners, so at least eight files per cycle. Cold reviews must be done by people not involved in the engagement. Findings go to an annual report to partners.
5. Remediation. Partners with serious file deficiencies should not supervise public interest entities or act as engagement quality reviewers until fixed, with root cause analysis.
6. Small-firm tools. As a smaller firm, it can use reciprocal reviews, standard manuals and external training.
7. Conclusion. The firm should appoint a quality partner, adopt the nine components, set up EQCRs for listed clients and a monitoring cycle, and document it all.

How to score full marks

• Know the nine components by heart. Governance and leadership; risk assessment; ethics; acceptance and continuance; human resources; engagement performance; monitoring and remediation; information and communication; documentation. A 6-mark “discuss the components” needs about six, each with a sentence on what the firm must do.
• Separate purposes from principles from elements. They are three different lists. Purposes say why, principles say the guiding beliefs, elements say what the system contains.
• For a 3-mark purposes question, give three distinct benefits with a short reason each: compliance and trust, early problem detection, and competitive advantage.
• Distinguish the four reviews by timing and trigger. Before or after signing, required or voluntary.
• For scenario questions, test against each component. Say which one is missing and what the firm should do.
• Time. Spend time in proportion to marks.

Common mistakes in the exam

• Mixing ISQM 1 (firm level) with ISA 220 (engagement level).
• Leaving out monitoring and remediation or information and communication.
• Confusing a hot review with an EQCR. The EQCR is required for listed and public interest entities. The hot review is voluntary.
• Saying a cold review is done before signing.
• Forgetting that monitoring inspects at least one completed engagement for each engagement partner.
• Giving a list of components with no explanation of what each requires.
• Forgetting ISQM 2 for the reviewer.
• Saying small firms do not need quality control.

Quick revision

• Need: lower risk of wrong opinion and negligence claims; avoid damages, lost clients, bad publicity, discipline.
• Objective: reasonable assurance that the firm and staff follow standards and law and reports are appropriate.
• Components: governance and leadership, risk assessment, ethics, acceptance and continuance, human resources, engagement performance, monitoring and remediation, information and communication, documentation.
• Reviews: peer; EQCR (before signing; listed and public interest entities); hot; cold (after signing).
• Monitoring: cyclical, at least one file per engagement partner; remediation; root cause; annual report to partners.
• Small firms: reciprocal review, third-party manuals, external training.

Practice questions

These are original questions written in the style of the ICAN exam. Try each one before you open the answer. Full model answers follow the written questions.

Recall check: multiple choice

The real ICAN paper has no multiple-choice section. These questions are for quick recall. The written questions that follow are closer to the exam.

Written questions

Model answers

Spotted a mistake? Tell us and we will check it.