I consider myself a dab hand in the kitchen – after all I have been doing it for years, own hordes of recipe books and have a mother who has a fix for every flop. Don’t get me wrong – I’m not claiming any Michelin stars here, but my husband bears ample (excuse the pun) testimony to my culinary skills. Even so, put another female in my kitchen and I always want a second opinion – is the salt right, have I spiced it too much, does the centre of the crème caramel have enough of a wobble in it? What’s my point again (sorry, the thought of crème caramel always sends me on a tangent) – yes – that everyone, no matter how accomplished, can always do with a bit of re-assurance. I suspect it’s no different for an audit practitioner. How wonderful it would be if every time you signed an audit report a voice from the heavens above would proclaim “Fear not my child, you have done right”. Oh ye of little faith, that voice is now here, only it does not come from the heavens. What, do I hear you say, am I on about? ISQC 1 of course, and its requirement for the performance of an engagement quality control review (EQCR) for appropriate engagements. But I mislead you – it was never the intention of the IAASB for this requirement to provide any kind of comfort or reassurance to the auditor. Rather, the requirement and in fact ISQC 1 itself, arose in response to increasing public demand for improvement in the quality of audits. It is not the intention of this article to examine the origin of ISQC 1 or its merits, instead I want rather to focus on paragraph 35 of ISQC 1, which states the following:
35. The firm shall establish policies and procedures requiring, for appropriate engagements, an engagement quality control review that provides an objective evaluation of the significant judgments made by the engagement team and the conclusions reached in formulating the report. Such policies and procedures shall: -evaluate to determine whether an engagement quality control review should be performed; and
(c) Require an engagement quality control review for all engagements, if any, meeting the criteria established in compliance with subparagraph 35(b).
As is evident from the requirement of paragraph 35 above, the standard makes mandatory the requirements for listed entities to be subject to an EQCR, and requires the firm to establish criteria against which all other engagements are to be assessed for EQCR applicability, for example, engagements of public interest or high risk engagements.
Be aware, however, that an EQCR does not involve a reperformance of the audit. On the contrary, the EQCR process is intended to be performed at a high level with the skeleton of the process laid out in paragraphs 37 and 38 as follows:
37. The firm shall establish policies and procedures to require the engagement quality control review to include:
(a) Discussion of significant matters with the engagement partner;
(b) Review of the financial statements or other subject matter information and the proposed report;
(c) Review of selected engagement documentation relating to significant judgments the engagement team made and the conclusions it reached; and
(d) Evaluation of the conclusions reached in formulating the report and consideration of whether the proposed report is appropriate.
38. For audits of financial statements of listed entities, the firm shall establish policies and procedures to require the engagement quality control review to also include consideration of the following:
(a) The engagement team’s evaluation of the firm’s independence in relation to the specific engagement;
(b) Whether appropriate consultation has taken place on matters involving differences of opinion or other difficult or contentious matters, and the conclusions arising from those consultations; and
(c) Whether documentation selected for review reflects the work performed in relation to the significant judgments and supports the conclusions reached.
Use of the word “include” leaves little doubt that the procedures listed comprise the bare minimum in terms of an EQCR. Other procedures to be performed will be dictated by the firm’s quality control policies and procedures as embodied in its quality control manual.
The type of EQCR as envisaged by paragraph 35 is what is commonly known as a pre-issuance review. In other words, the review needs to be performed in conjunction with the performance of the audit with a prohibition on the signing of the audit report prior to completion of the pre-issuance review. The pre-issuance review is of course not the only type of EQCR. Paragraph 48 further requires an inspection, on a cyclical basis, of at least one completed engagement per engagement partner as part of the firm’s ongoing monitoring process. Such a review is commonly known as a post-issuance review and is performed after the audit report has been issued.
The benefits of an EQCR (whether it be pre-issuance or post-issuance) have long been recognised by the IFAC Code of Ethics, and indeed even in our very own Code of Professional Conduct, both of which acknowledge an EQCR as an effective safeguard against certain types of threats, such as self review threats. EQCRs have gained even more prominence with the recent revision of section 290 of the IFAC Code, which now requires the performance of an EQCR (whether pre-issuance or post-issuance is up to the auditor’s professional judgement) in addition to certain disclosures, when a significant self review threat arises.
Not only the IFAC Code, but even the Sarbanes Oxley Act of 2002, details a requirement for the Public Company Accounting Oversight Board (PCAOB) to include in its standards that each registered public accounting firm “provide a concurring or second partner review and approval of such audit report (and other related information), and concurring approval in its issue, by a qualified person (as prescribed by the Board) associated with the public accounting firm, other than the person in charge of the audit, or by an independent reviewer (as prescribed by the Board). In response, the PCAOB earlier this year approved Auditing Standard 7 Engagement Quality Review, the purpose of which, according to PCAOB Chairman Mark W Olsen, is to “focus on the engagement quality control reviewer’s attention on the areas that are most likely to contain a significant engagement deficiency and increases the likelihood of identifying and correcting those deficiencies before the audit report is issued”. The need for an entire auditing standard on the matter surely bears witness to the role of the EQCR in ensuring a quality audit.
In the South African context, we of course have the Practice Review department of the Independent Regulatory Board for Auditors, which in terms of Section 47 of the Auditing Profession Act No. 26 of 2005, performs engagement reviews on a cyclical basis. The engagement to be selected by the practice reviewer is anyone’s guess but an established EQCR process at a firm level can assist in identifying general quality deficiencies in an engagement, which can then be applied to all engagements undertaken by the firm and fixed going forward.
EQCRs however require a certain degree of technical expertise, skill and experience, which may not necessarily be available in-house, more so in the case of sole practitioners and smaller firms. In such situations, practitioners should look to paragraph A50, which recommends that such firms seek suitably qualified external persons to perform such reviews. It goes without saying that this option comes with a price tag.
It may even be argued, particularly in the case of pre-issuance reviews, that such a process could cause significant delays in the audit process, thus hampering the firm’s ability to meet its deadline. Proponents of this argument have obviously not read paragraph A43, which requires that the EQCR be concluded in a timely manner at appropriate stages during the engagement, thus allowing for significant issues to be resolved before the date of the audit report. Thus, all it takes, is a little planning!
There is no doubt that public confidence in the auditing profession has waned over the last decade or so. More so, then, the need for self-regulation tools such as EQCRs, which serve as meaningful contributors to regaining that trust. Coming back to the question in my title, it seems to me that that EQCR is here to stay and rightfully so, as the odds are firmly stacked in favour of Gain.
Taskeen Abdool Majid CA(SA), BSc, has a postgraduate certificate in advanced taxation and is a Quality Reviewer at Protect a Partner.
