Manage your Practice: ISQM 1: Monitoring and Remediation

The sixth workshop took place on 9 September 2022 and addressed Monitoring and Remediation, which is one of the eight components in ISQM 1. During this workshop, panel members answered the following important questions:

1. If a firm provides services other than audit, are there other files that should be selected for a monitoring review?ISQM 1 requires that each engagement partner be subject to at least one completed engagement being reviewed in a cycle. An engagement partner is the partner or other person in the firm who is responsible for the engagement and its performance, and for the report that is issued on behalf of the firm, and who, where required, has the appropriate authority from a professional, legal or regulatory body.
   If an engagement partner has issued a report under any of the IAASB standards, for example for independent reviews, agreed-upon procedures or compilations, these would be included as part of and in scope for selection for monitoring. However, as ISQM 1 is a risk-based approach to quality management, if engagement partners of the firm are issuing other reports that are not in terms of the IAASB standards, these should ideally also be included in the scope of engagements that are subject to monitoring. The requirement is that each engagement partner should be subject to a review of a completed engagement in a cycle. This promotes the overall quality of the firm.
   The firm will however have to perform those monitoring reviews on the non-IAASB engagements using the standards and frameworks that those reports were issued under, such as the International Standards for the Professional Practice of Internal Auditing for internal audit reports.
2. How does it affect the monitoring activities when there is a change to the System of Quality Management (SoQM) to address an identified deficiency or there are changes in quality objectives, quality risks or responses because of changes in the nature and circumstances of the firm and its engagements?
   When changes do occur, then previous monitoring activities may no longer be applicable. A change in the approach will be required and if this happens mid-year then it is suggested that a guidance document be included in the relevant monitoring evidence to demonstrate the before and aftereffects of the changes. This is to ensure there is no break in the cycle of monitoring and the risk of a deficiency not being identified has been sufficiently managed in the cross-over period.
3. ISQM 1 requires you to accumulate findings from relevant sources when evaluating findings.
   Firstly, what are the findings?
   And secondly, what sources of information are relevant, to evaluate findings and identify deficiencies?
   Findings are information about the design, implementation and operation of the SoQM identified from the performance of monitoring activities, external inspections and other relevant sources which may indicate an area requiring improvement at the engagement level and/or SoQM level.
   Findings can be identified from the following sources of information:
   1 Regulatory reviews at both a firm and an engagement level
   2 Ongoing and periodic monitoring
   3 Restatements/ prior year adjustments, and
   4 Complaints, claims or potential claims that relate to professional services, ethical issues or any other matters from parties outside of the firm.
4. Can you give an example of a deficiency that would affect the firm and explain how the root cause is addressed?
   The monitoring processes could identify that an audit report has been issued which is not using the latest template applicable to the engagement. Further investigation of the root cause may reveal that the template being used by the firm was not updated, and it’s still the old template being used. As the old template was used by everyone in the firm, this would potentially mean that all the reports that have been issued by the firm using the old template are incorrect.
   Steps the firm could then take would be to communicate to the firm that the old template should not be used and where the new template may be accessed. The firm would then need to consider whether the reports that have been issued using the old template should be withdrawn and reissued, or dealt with in another way, depending on the nature of the difference between the old and new reporting template.
   It should be noted that the report issued by the firm is pretty much the only document that the public sees in relation to the work performed on an engagement.
   So, it’s very important in relation to how the public would perceive a specific firm, but also the entire accounting profession. This is why audit regulators place so much importance on the audit report being technically correct when they perform their regulatory reviews.
5. How do you assess or evaluate a deficiency if it is not remediated within one year or is only partially remediated?
   Should a deficiency not be remediated, this could indicate other deficiencies within the design of the root cause analysis process. The initial assessment of the pervasiveness of a deficiency and whether the associated controls are complete (ie, the rigour of identifying the causes (including any culture indicators)) is imperative to ensure that a deficiency is remediated or partially remediated timeously.Should a deficiency be present in year 2, it is recommended that additional explanations are provided within your SoQM as to why the deficiency is not fully remediated, and a more regular assessment of remediation is required.
6. What do you do if you find, in investigating the root cause(s) of an identified deficiency that there are circumstances that have similarities to other circumstances where there were findings that were not considered a deficiency?
   In such instances, you may need to adjust your evaluation of the other findings and classify them as a deficiency too.
7. You can no longer just assess whether the actions taken to remediate deficiencies have been implemented. You also need to assess whether those actions taken are effective (ie, achieve the desired outcome based on the root causes identified).
   Why is this important and how do you evaluate whether the remedial actions implemented to address previously identified deficiencies, are in fact effective?
   Your list of remedial actions taken should ideally be treated as a live document.
   An important element of this document is the firm’s ongoing monitoring of the effectiveness of remedial actions and implementation of further adjustments, when appropriate. This type of self-monitoring and self-correcting will allow firms to more timely identify instances where initial remediation efforts appear not to be sufficiently responsive in terms of design or implementation, and to react accordingly.
   An assessment of the existing ongoing and periodic monitoring in place should be analysed to conclude if changes to the nature, timing and extent of the monitoring activities are needed to ensure that the deficiencies identified are remediated on a timely basis.
   This might for example include performing your periodic monitoring on a more regular basis and not only on an annual basis if that was your firm’s approach in the past.
8. How do we communicate with those charged with governance when performing audits of financial statements of listed entities about how the SoQM supports the consistent performance of quality engagements?
   Through a transparency report or a similar report, information relating to the various SoQM elements within your firm can be documented. Input can be obtained from the various and many functions at the firm.
   The Risk and Quality division (or similar) of the firm will manage the process to ensure appropriate, accurate and transparent communication.
   A letter (template prepared by the Risk and Quality division of the firm) can be circulated to all engagement teams (addressed to client leadership) which summarises the firm’s SoQM self-evaluation for the year.
   The Risk and Quality division of the firm will monitor compliance with the requirement to communicate with those charged with governance through a listing of all audit clients. Engagement teams should be responsible for sending the Risk and Quality division of the firm the finalised letter to ensure compliance with processes that are designed and in place for this communication.

To watch the recording of this workshop and register for our upcoming workshops, click here.

Notes
1 International Standard on Quality Management (ISQM) 1, Quality Management for Firms that Perform Audits or Reviews of Financial Statements, or Other Assurance or Related Services Engagements.
2 International Standard on Quality Management (ISQM) 2, Engagement Quality Reviews.
3 International Standard on Auditing (ISA) 220, Quality Management for an Audit of Financial Statements.

Authors
Martin Lange CA(SA) RA CIA, Director at ML Advisory; Jacqui Mauer CA(SA) RA, Member of SAICA’s Quality Management Implementation Initiative Task Group; Mariska van Dyk CA(SA), Member of SAICA’s Quality Management Implementation Initiative Task Group; and Michelle Vermeulen CA(SA) SAICA Project Manager: Audit and Assurance