Manage your Practice: ISA 220 (Revised): Quality Management for an Audit of Financial Statements

The eighth workshop took place on 7 November 2022 and addressed ISA 220 (Revised). During this workshop, panel members answered the following important questions:

1. The audit engagement is performed within the context of the firm having a System of Quality Management (SOQM) in compliance with ISQM 1 (or another requirement that is at least as demanding).
   ISA 220 (Revised) states that the engagement team needs to communicate information to the firm to support the design, implementation and operation of the firm’s SOQM.
   What type of information may need to be communicated by the engagement team?The engagement team may have to communicate quite a few types of matters to the firm.
   Remember that the engagement team has the responsibility to implement the firm’s policies and procedures at engagement level on that audit engagement. Engagement partners and teams may normally rely on the firm’s SOQM, but cannot blindly rely on it without considering whether the firm’s policies and procedures are fit-for-purpose in the specific circumstances.
   If the team becomes aware of policies or procedures that will not be effective in the context of the specific engagement, the firm needs to be made aware of this instance. The consequence in this instance is that, firstly, there is a possibility that a quality risk will not be addressed in this engagement. A different response would have to be designed and implemented on this specific engagement so that it can still sufficiently address the quality risk. At the same time, if or when this engagement is monitored, the monitoring activity would have to be amended to consider that a different response was implemented for this specific engagement.
   It is also possible that the engagement team becomes aware that a specific response is not working (let’s say there is a problem in the audit software which results in a specific quality risk that is not being addressed). This problem will impact more than just the one engagement, so the firm should ideally address the problem at firm level (and as quickly as possible) so that all audit engagements will still sufficiently address the quality risk as was intended by the response.
   Then, it may also be necessary to communicate specific information about the audit engagement to the firm so that the firm can use that information to monitor quality risks and even to select matters for monitoring and other activities.
   One example here could be that the engagement team must record an instance of consultation in the firm’s register for consultations whenever a consultation was concluded on an audit. Another example could be to communicate, or even confirm, whether the entity is a public interest entity or not. In a South African context, the company’s public interest score can also be useful information that is monitored at firm level, but that is only confirmed at engagement level and needs to be communicated or recorded in the firm’s registers (which also forms part of the firm’s SOQM).
2. The engagement partner, being overall responsible for managing and achieving quality, should create an environment that emphasizes the firm’s culture and expected behaviour.
   In doing so, the engagement partner should be sufficiently and appropriately involved throughout the audit.
   How can the engagement partner demonstrate his or her involvement in the audit engagement?Firstly, through his or her personal conduct and actions (leading by example).
   The engagement partner can demonstrate his or her involvement in the audit engagement through actions such as:
   (1) Conducting regular update meetings with supervisors or the firm’s experts to discuss progress and issues arising, particularly those related to significant matters and significant judgements identified.
   (2) The engagement partner can also speak directly with engagement team members and direct, supervise and review their work. I recall the impact it had on me as a first-year team member when the engagement partner visited the client and engaged with all of us to discuss key audit matters. It highlighted the relevance or importance of my contribution and influenced my understanding of the effect of the audit evidence I obtained and documented. In this regard technology and our remote workways following the COVID-19 pandemic provide us with alternative ways of engagement with engagement team members, where physical presence is not possible.
   (3) The engagement partner can also visit the engagement team’s locations, depending on the size, complexity, and geographical dispersions of the audit client.
   Secondly, the engagement partner should clearly communicate the expected behaviour of the engagement team members. The way of communication may be impacted by the size and complexity of the engagement. With a smaller engagement team with few engagement team members, the interaction between the engagement partner and engagement team may be more direct, whereas in the case of a large engagement team dispersed over many locations, more formal communication may be required.
   Another way of demonstrating involvement is that the engagement partner clearly determines and communicates the nature, timing and extent of direction, supervision and review of the engagement team and the work they perform. Managers and supervisors are extensions of the engagement partner, and they should reinforce the commitment to quality by communicating expected behaviour to other members of the engagement team.
3. With regard to the delegation of responsibilities, the IAASB recognised that engagement partners need to assign some responsibilities to other senior members of the engagement team, particularly in more complex team structures.
   The delegation of the responsibilities should however be done in a manner that the engagement partner continues to take overall responsibility for managing and achieving quality on the audit engagement.
   How does the engagement partner assign responsibilities to others and still demonstrate sufficient and appropriate involvement throughout the audit engagement?Yes, considering all the responsibilities of engagement partners, effective delegation of responsibilities is crucial to achieving the desired outcomes of audit engagements, which includes audit quality. Effective delegation includes clear communication to those assigned the responsibilities, what the nature of their responsibilities are and what their authorities are. Assignees should be clear on what they are responsible for. This includes the scope of the work being assigned and the objectives thereof − that is, what is assigned and why is it assigned.
   Secondly, engagement partners should continue to direct and supervise the managers and supervisors. They also need guidance on how to resolve difficult matters which not only include audit matters but also staff- and client-related matters. In the industry, these managers and supervisors often have limited experience in managing engagements and teams and need direction from their engagement partners.
   Thirdly, the engagement partners should review their work to evaluate the conclusions that they have reached. This will assist the engagement partner towards the end of the engagement when performing the ‘stand back’ step, to conclude whether he or she has a basis for determining that the significant judgements made, and the conclusions reached are appropriate.
4. Thando mentioned that engagement teams are required to plan and perform an audit with professional scepticism and to exercise professional judgement.
   How can the engagement team demonstrate professional scepticism?Based on my experience, it can be difficult to demonstrate that members of the engagement team exercised professional scepticism. It has been a recurring inspection finding that the documented audit evidence does not reflect that the auditor applied professional scepticism.
   ISA 220 (Revised), particularly the application material, provides guidance in this regard. The engagement team can consider during the development of the overall audit strategy whether conditions exist that may create pressures on the engagement team that may impede the appropriate exercise of professional scepticism. Examples of impediments include budget constraints that may discourage the use of sufficiently experienced or technically qualified resources, tight deadlines that may limit the time available to analyse complex information, and the lack of cooperation of management or undue pressures by management that may affect the ability to resolve complex or contentious issues.
   Actions to mitigate impediments to professional scepticism may include remaining alert to changes in the engagement circumstances that necessitate additional or different resources for the engagement and involving more experienced members of the engagement team in certain activities such as resolving complex or contentious issues.
   The engagement partner can modify the nature, timing and extent of direction, supervision, or review by involving more experienced engagement team members, more in-person oversight on a more frequent basis, or more in-depth reviews of areas such as complex or subjective areas of the audit, areas with a fraud risk, identified or suspected non-compliance with laws or regulations.
   The engagement partner can also explicitly alert the engagement team to instances or situations where unconscious or conscious biases may impede the exercise of professional scepticism. An example of instances where bias may impede scepticism is areas involving judgement. The team members should be encouraged to seek advice from more experienced team members and/or the engagement partner can modify the nature, timing and extent of direction, supervision, or review.
   The engagement partner, together with those to whom responsibilities of supervision were assigned (such as managers), should emphasize the importance of each engagement team member exercising professional scepticism throughout the audit.
5. SA 220 (Revised) requires that the engagement partner must take responsibility for other members of the engagement team to be made aware of the relevant ethical requirements that are applicable to the audit engagement.
   The engagement partner must also take responsibility for determining whether the relevant ethical requirements have been fulfilled, prior to dating the auditor’s report.
   In instances where the engagement team members include one or more persons that are not employed by the firm itself, how can the engagement partner meet these requirements?This can sound like a tricky situation, because normally an engagement partner would consider the firm’s policies and procedures and rely on those to ensure that the engagement team have completed the relevant training to raise awareness. Or the team members have completed independence declarations using the firm’s systems.
   When engagement team members are, however, not employed by the firm, these individuals will not have been subject to the firm’s training that addresses the firm’s policies or procedures for relevant ethical requirements. The individuals would also possibly not have access to the firm’s system to declare their independence.
   One practical example here includes a scenario where the firm uses another auditor to attend to a client’s inventory count.
   In this instance, it may be necessary for the engagement partner (or someone else) to communicate the firm’s relevant policies and procedures to this individual so that he or she will be able to follow the firm’s policies and procedures when the circumstances arise. In terms of the independence declaration, the firm will need to obtain written confirmation from the individual.
   The team would therefore have to provide these individuals with some sort of instructions before they are engaged to work on the audit. These instructions would include the firm’s policies and procedures, possibly provide information about the allocated time budget, and confirm their independence and even their competence.
6. ISA 220 (Revised) includes a new requirement that the engagement partner shall consider information obtained in the acceptance and continuance process in planning and performing the audit engagement.
   What is the type of information obtained during the acceptance and continuance that may assist the engagement partner with complying with this requirement of ISA 220 (Revised)?Based on my experience, the engagement partner is often involved in the acceptance and continuance of client relationships and audit engagements. That is however not always the case.
   When the engagement partner is not directly involved throughout the acceptance and continuance process, the engagement partner should determine that the firm’s policies or procedures have been followed and that the conclusion reached in this regard is appropriate. The engagement partner may use the information considered by the firm in determining that the conclusion reached regarding the acceptance or continuance is appropriate.
   If the engagement partner has concerns regarding the appropriateness of the conclusion reached, the engagement partner should discuss the basis for the conclusion with those involved in the acceptance or continuance.
   When the engagement partner is involved in the acceptance and continuance process, the engagement partner should provide the audit evidence obtained during the acceptance and continuance process to those documenting the evidence. When the process is performed by individuals outside of the engagement team, the members of the engagement team should ensure that the audit evidence required in accordance with the ISAs is included in the audit documentation.
   Information obtained during the acceptance and continuance process can, and should, affect the audit strategy and plan, execution, and communication with the audit client.
   For example, information about the size, complexity and nature of the entity can assist with identifying and assessing the risk of material misstatement and determine whether, and how, auditors’ experts are used. Or the timetable for reporting can influence the resources required and the identification and assessment of the risk of material misstatement. Knowledge about the governance structure will determine to whom audit matters are communicated and even the format.
   For a recurring engagement, information on any changes in the entity or its industry that may affect resources is required, as well as the identification and assessment of risks of material misstatement.
   In relation to group audits, an understanding of the nature of the control relationship between the parent and its components influences the direction, supervision and review of work of component auditors.
7. ISA 220 (Revised) also requires that the engagement partner must determine that the team collectively have the appropriate competence and capabilities, including sufficient time.
   If the engagement partner determines that the resources made available for the audit are insufficient or inappropriate in the circumstances, what types of action can the engagement partner take to ensure that additional or alternative resources are assigned or made available?Let me start by stating that I’m sure most auditors carefully consider the allocation of staff and other resources to their engagements so that they can avoid getting into this situation in the first place.
   However, we also know that it can happen that another engagement has an unexpected problem and runs over its deadline, using more time of your engagement team members (or your staff unexpectedly must go on study leave for writing supplementary exams) and then you find yourself in a position where you need more engagement team members. Similar scenarios can also arise in terms of technological or intellectual resources.
   In a group audit, if the lack of resources is at the component auditor, then the engagement partner should discuss the matter with the component auditor or, if the component audit can’t obtain the necessary resources, the firm may have to provide the necessary resources to the component auditor. This may involve staff, but also technological or intellectual resources. Practically, it could therefore mean that the engagement partner may make software tools or a sampling methodology available to the component auditors, as needed.
   In another scenario, if your client is early adopting a new accounting standard (or they had a shorter financial period ending, let’s say, on 30 June 2022, and ISA 315 (Revised 2019) needed to be applied), then you need to ensure that your audit methodology or audit tool is updated for the changes to the standard. If this is not the case, then the engagement partner will need to inform the firm as early as possible so that the firm can either update the software and issue an updated version, or it can provide an alternative resource that will enable the engagement team to comply with the new standard, therefore ensuring a quality audit engagement.
   In a scenario where you don’t have enough staff, or staff with the necessary experience, it may help to try and extend reporting deadlines, if you can agree on those with your client. Alternatively, it may be necessary to change the planned approach to the nature, timing and extent of the direction, supervision and review of the engagement. In this case, it may be necessary for the audit manager and other reviewers to be more regularly available to provide guidance and direction and to perform a more detailed review of the work performed.
   Of course, if you can foresee this problem, you may decide to do some of the audit work at an interim stage, which will leave less detailed work to be performed after the period end.
   Lastly, if the engagement partner is unable to obtain the necessary resources, the firm’s policies and procedures for resolving differences of opinion would need to be followed.
8. The engagement partner is required to review specific audit documentation at appropriate points during the audit engagement.
   What should the engagement partner consider when determining which audit documentation to review?Firstly, the engagement partner should review all the documentation required by ISA220 (Revised), namely documentation related to significant matters, significant judgements and other matters based on professional judgement to execute his or her responsibilities. Prior to the date of the auditor’s report, the engagement partner shall also review the financial statements, auditor’s report, and related audit documentation. The engagement partner shall furthermore review formal written communication to management, those charged with governance or regulatory authorities.
   To determine which areas of significant judgements require review, the engagement partner should consider their firm’s policies and procedures that may specify certain matters that are commonly expected to be significant judgements.
   Furthermore, the engagement partner should consider matters related to the overall audit strategy and plan, execution of the engagement, and the overall conclusions reached by the engagement team.
   Examples of areas of significant judgements related to the overall audit strategy and audit plan include determining materiality, the consideration of inherent risk factors, and the assessment of inherent risks and decisions with regard to the use of auditor’s experts or personnel with specialised skills in information technology, auditing, or accounting.
   Examples of areas of judgement during the execution of the engagement include results of procedures performed by the engagement team on significant areas of the audit, for example conclusions reached in respect of certain accounting estimates or going concern considerations.
   Examples of areas of judgement that relate to the overall conclusions reached include the significance of corrected and uncorrected misstatements and the proposed audit opinion and matters communicated in the auditor’s report.
   In applying his/her professional judgement in determining other matters to be reviewed to fulfil his or her responsibilities, the engagement partner may consider which engagement team member performed the work and matters related to recent inspection findings.
   To demonstrate that engagement partners fulfilled their review responsibility, the engagement partners should document the date and extent of review in accordance with ISA 230.
9. How can the engagement partner use the information that the firm communicates about its monitoring and remediation process to determine the relevance and effect thereof on the audit engagement?The standard requires the engagement partner to understand the information that is communicated. This includes remedial actions designed and implemented by the firm to address identified deficiencies.
   The engagement partner should consider to what extent those deficiencies AND their remedial actions are relevant to the audit engagement.
   The engagement partner will probably identify one of the following options:
   1 The deficiency and the remedial action are not relevant to the specific audit (or it won’t affect the quality of this audit). Then no action is needed.
   2 The deficiency and/or the remedial action are relevant to the audit and the engagement partner determines to what extent the remedial action that is implemented by the firm will affect audit quality positively in the audit engagement. If the firm’s remedial action is sufficient, then the engagement team will apply that remedial action and that will suffice.
   3 Another scenario could be where the engagement partner determines that additional remedial actions are required for the audit. That is over and above the remedial actions designed and implemented by the firm. The engagement partner may, for example, decide to use an auditor’s expert or to change (or expand) the nature, timing and extent of direction, supervision and review.
10. ISA 220 (Revised) now includes the stand-back provision with the objective that the engagement partner reflects on his or her own involvement to conclude whether he or she has taken overall responsibility for managing and achieving quality on the audit engagement.
    What are examples of situations where the engagement partner may not be able to conclude that there was sufficient and appropriate involvement and what actions can be taken to address such a situation?In exercising their judgement about the adequacy of their own involvement, the engagement partner determines whether their own involvement provides the basis for determining that the significant judgements made, and the conclusions reached are appropriate.
    Examples of inadequate involvement provided in the application material of ISA 220 (Revised) include:
    1 Lack of timely review by the engagement partner of the audit plan, including the review of the assessment of risk of material misstatement and the design of responses.
    2 Evidence that the direction and supervision by the engagement partner were not adequate. (It is worth noting with regard to this matter that a conforming amendment to ISA 300, paragraph 9(a), now requires that the audit plan includes a description of the nature, timing and extent of the planned direction, supervision and review activities.)
    3 Lack of evidence that the engagement partner provided adequate direction and supervision to the engagement team members and review of their work.
    If the engagement partner concludes that their involvement was not adequate, they will be unable to conclude that they have taken overall responsibility for managing and achieving quality on the audit engagement. The engagement partner should consider actions to remedy the situation, which may include updating and changing the audit plan, modifying the nature and extent of review, increasing the involvement of the engagement partner, or consulting with the personnel in the firm responsible for the firm’s SOQM. The firm’s policies or procedures may also direct the required action to be taken in such circumstances.
11. How can the documentation reflect that the audit team, and especially the engagement partner, has complied with the performance requirements of ISA 220 (Revised)?
    Do you need any special documentation or checklists to prove this?The standard makes it clear that it is not necessary or practicable to document every matter that was considered or every instance where professional judgement was applied in an audit.
    It is also not necessary for the audit documentation to include checklists to tick off, that requirements have been met when the engagement file already contains working papers as evidence that specific requirements have been complied with.
    So, if a requirement has been complied with by preparing a working paper, that working paper is sufficient evidence.
    We could ask ourselves what other documentation may be necessary, and the application material provides quite a few helpful examples.
    Some of these include:
    Signoffs by the engagement partner, for example signing off the audit plan and possible project management activities to show that the engagement team was given direction by the engagement partner.
    Time records of the engagement partner to show how much time the engagement partner has spent on the engagement. These records could also provide evidence that the engagement partner was involved throughout the audit and that he or she provided supervision of the engagement team. (Now, given that some firms don’t require engagement partners to record timesheets anymore, firms may need to give some consideration to how they will reflect the engagement partner’s time spent on an engagement if no timesheets are recorded.)
    Agendas and minutes of meetings within the team. The standard suggests that keeping minutes of meetings of the engagement team will provide evidence of the clarity, consistency and effectiveness of the engagement partner’s communications in respect of the culture of quality and the expected behaviours that demonstrate the firm’s commitment to quality. Keeping records of team discussions is not a new idea (or even a new requirement), but it is often a matter where engagement teams can improve what and how much they document in their engagement files. The implementation of ISA 220 (Revised) may be the ideal time to place some new emphasis on the quality of meeting minutes included in the engagement file.

Notes
1 International Standard on Quality Management (ISQM) 1, Quality Management for Firms that Perform Audits or Reviews of Financial Statements, or Other Assurance or Related Services Engagements.
2 International Standard on Quality Management (ISQM) 2, Engagement Quality Reviews.
3 International Standard on Auditing (ISA) 220, Quality Management for an Audit of Financial Statements.

To watch the recording of this workshop and register for our upcoming workshops, click here.

Authors
Juané Schreuder CA(SA) and Christine Rossouw CA(SA) are independent consultants and Michelle Vermeulen CA(SA) is the Project Manager: Assurance at SAICA