Auditing Standard ASQM 1 Quality Management for Firms that Perform Audits or Reviews of Financial Reports and Other Financial Information, or Other Assurance or Related Services Engagements (Cth)
| ASQM 1 (March 2021) |
Auditing Standard ASQM 1
Quality Management for Firms that Perform Audits or Reviews of Financial Reports and Other Financial Information, or Other Assurance or Related Services Engagements
Issued by the Auditing and Assurance Standards Board
Obtaining a Copy of this Auditing Standard
This Auditing Standard is available on the Auditing and Assurance Standards Board (AUASB) website: Details
| Auditing and Assurance Standards Board Podium Level 14, 530 Collins Street Melbourne Victoria 3000 AUSTRALIA | Phone: (03) 8080 7400 Postal Address: PO Box 204, Collins Street West |
COPYRIGHT
© 2021 Commonwealth of Australia. The text, graphics and layout of this Auditing Standard are protected by Australian copyright law and the comparable law of other countries. Reproduction within Australia in unaltered form (retaining this notice) is permitted for personal and non‑commercial use subject to the inclusion of an acknowledgment of the source as being the Australian Auditing and Assurance Standards Board (AUASB).
Requests and enquiries concerning reproduction and rights for commercial purposes within Australia should be addressed to the Technical Director, Auditing and Assurance Standards Board, PO Box 204, Collins Street West, Melbourne, Victoria 8007 or sent to [email protected]. Otherwise, no part of this Auditing Standard may be reproduced, stored or transmitted in any form or by any means without the prior written permission of the AUASB except as permitted by law.
This Auditing Standard reproduces substantial parts of the corresponding International Standard on Quality issued by the International Auditing and Assurance Standards Board (IAASB) and published by the International Federation of Accountants (IFAC), in the manner described in the statement on Conformity with International Standards on Quality . The AUASB acknowledges that IFAC is the owner of copyright in the International Standard on Quality incorporated in this Auditing Standard throughout the world.
All existing rights in this material are reserved outside Australia. Reproduction outside Australia in unaltered form (retaining this notice) is permitted for personal and non-commercial use only.
Further information and requests for authorisation to reproduce this Auditing Standard for commercial purposes outside Australia should be addressed to the Technical Director, Auditing and Assurance Standards Board, PO Box 204, Collins Street West, Melbourne, Victoria 8007 or sent to [email protected]. Any decision to approve a request may also require the agreement of IFAC.
ISSN 1833-4393
CONTENTS
PREFACE
AUTHORITY STATEMENT
CONFORMITY WITH INTERNATIONAL STANDARDS ON QUALITY
Paragraphs
Application................................................................................................................. Aus 0.1
Operative Date.......................................................................................................... Aus 0.2
Introduction
Scope of this Auditing Standard.................................................................................. 1-5
The Firm’s System of Quality Management................................................................ 6-11
Authority of this ASQM.............................................................................................. 12
Effective Date............................................................................................................. 13
Objective.................................................................................................................... 14-15
Definitions.................................................................................................................. 16
Requirements
Applying, and Complying with, Relevant Requirements............................................. 17-18
System of Quality Management.................................................................................. 19-22
The Firm’s Risk Assessment Process.......................................................................... 23-27
Governance and Leadership....................................................................................... 28
Relevant Ethical Requirements................................................................................... 29
Acceptance and Continuance of Client Relationships and Specific Engagements....... 30
Engagement Performance........................................................................................... 31
Resources................................................................................................................... 32
Information and Communication................................................................................ 33
Specified Responses................................................................................................... 34
Monitoring and Remediation Process.......................................................................... 35-47
Network Requirements or Network Services............................................................... 48-52
Evaluating the System of Quality Management........................................................... 53-56
Documentation........................................................................................................... 57-60
Application and Other Explanatory Material
Scope of this ASQM................................................................................................... A1-A2
The Firm’s System of Quality Management................................................................ A3-A5
Authority of this ASQM.............................................................................................. A6-A9
Definitions.................................................................................................................. A10-A28
Applying, and Complying with, Relevant Requirements............................................. A29
System of Quality Management.................................................................................. A30-A38
The Firm’s Risk Assessment Process.......................................................................... A39-A54
Governance and Leadership....................................................................................... A55-A61
Relevant Ethical Requirements................................................................................... A62-A66
Acceptance and Continuance of Client Relationships and Specific Engagements....... A67-A74
Engagement Performance........................................................................................... A75-A85
Resources................................................................................................................... A86-A108
Information and Communication................................................................................ A109-A115
Specified Responses................................................................................................... A116-A137
Monitoring and Remediation Process.......................................................................... A138-A174
Network Requirements or Network Services............................................................... A175-A186
Evaluating the System of Quality Management........................................................... A187-A201
Documentation........................................................................................................... A202-A206
PREFACE
Reasons for Issuing ASQM 1
The AUASB issues Auditing Standard ASQM 1 Quality Management for Firms that Perform Audits or Reviews of Financial Reports and Other Financial Information, or Other Assurance or Related Services Engagements pursuant to the requirements of the legislative provisions and the Strategic Direction explained below.
The AUASB is a non corporate Commonwealth entity of the Australian Government established under section 227A of the Australian Securities and Investments Commission Act 2001, as amended (ASIC Act). Under section 336 of the Corporations Act 2001, the AUASB may make Auditing Standards for the purposes of the corporations legislation. These Auditing Standards are legislative instruments under the Legislation Act 2003.
Under the Strategic Direction given to the AUASB by the Financial Reporting Council (FRC), the AUASB is required, inter alia, to develop auditing standards that have a clear public interest focus and are of the highest quality.
Main Features
This Auditing Standard represents the Australian equivalent of ISQM 1 Quality Management for Firms that Performs Audits or Reviews of Financial Statements, or Other Assurance or Related Services Engagements (December 2020) and will replace the current ASQC 1 issued by the AUASB in November 2013.
This Auditing Standard contains differences from ISQM 1, which addresses the most relevant public interest issues related to firms’ systems of quality control, including those highlighted in the Invitation to Comment (ITC) released in December 2015, Enhancing Audit Quality in the Public Interest: A Focus on Professional Scepticism, Quality Control and Group Audits.
ASQM 1 introduces a quality management approach that is focused on proactively identifying and responding to risks to quality. The new quality management standard includes other enhancements to address key issues highlighted in the ITC to improve the robustness of firms’ systems of quality management (e.g., enhanced requirements and focus on governance and leadership, monitoring and remediation, and circumstances when a firm belongs to a network). The essence of the new approach is to focus firms’ attention on risks that may have an impact on engagement quality. The new approach requires a firm to customise the design, implementation and operation of its system of quality management based on the nature and circumstances of the firm and the engagements it performs.
AUTHORITY STATEMENT
The Auditing and Assurance Standards Board (AUASB) makes this Auditing Standard ASQM 1 Quality Management for Firms that Perform Audits or Reviews of Financial Reports and Other Financial Information, or Other Assurance or Related Services Engagements pursuant to section 227B of the Australian Securities and Investments Commission Act 2001 and section 336 of the Corporations Act 2001.
This Auditing Standard is to be read in conjunction with ASA 101 Preamble to Australian Auditing Standards, which sets out the intentions of the AUASB on how the Australian Auditing Standards, operative for financial reporting periods commencing on or after 1 January 2010, are to be understood, interpreted and applied.
Dated: 10 March 2021 W R Edge
Chair - AUASB
Conformity with International Standards on Quality Management
This Auditing Standard conforms with International Standard on Quality Management ISQM 1 Quality Management for Firms that Performs Audits or Reviews of Financial Statements, or Other Assurance or Related Services Engagements issued by the International Auditing and Assurance Standards Board (IAASB), an independent standard‑setting board of the International Federation of Accountants (IFAC).
Paragraphs that have been added to, or amended from this Auditing Standard (and do not appear / appear differently in/from the text of the equivalent ISQM 1) are identified with the prefix “Aus”.
The following introductory paragraphs and definitions are additional to or have been amended from ISQM 1:
| Paragraph | Summary of Change |
| Aus 4.1 | Replaces ISQM 1 introductory paragraph 4, to introduce ASA 102 Compliance with Ethical Requirements when Performing Audits, Reviews and Other Assurance Engagements. |
| Aus 4.2 | Additional to ISQM 1 to serve as a reminder that it is the responsibility of the firm to ensure compliance with all relevant legal, regulatory or professional obligations. |
| Aus 10.1 | Replaces ISQM 1 paragraph 10 scalability, as the example used in ISQM 1 references Compilation Engagements. The AUASB does not issue a Compilation Engagement standard. |
| Aus 16.1-Aus16.2 and 16.5 | Additional to ISQM 1, to include definitions of ‘Assurance engagement’, ‘Assurance practitioner’ and ‘Other financial information’, within the legislative instrument of ASQM 1. |
| Aus 16.3 | Additional to ISQM 1 to include definition of ‘Date of report’, to represent current Australian principles and practices of dating reports. |
| Aus 16.4 | Replaces ISQM 1 paragraph 16(f) definition of ‘Engagement team’, to remove the reference to direct assistance of internal audit which is prohibited in Australia, consistent with ASA 610 Using the Work of Internal Auditors. |
| Aus 16.5 | Additional to ISQM 1, to include the definition of ‘Other financial information’. Consistent with ASA 100 Preamble to AUASB Standards, although Auditing Standards are written mainly in the context of an audit of a financial report, they apply also, as appropriate, to the audit of other financial information. |
| Aus 16.6 | Replaces ISQM 1 paragraph 16(m) definition of ‘Partner’, which references the term ‘professional services engagements’. This term is not defined within Australia and has been replaced with the words audit, review, other assurance engagement or related services engagement. |
| Aus 16.7 | Replaces ISQM paragraph 16(p) definition of ‘Professional standards’. The AUASB Preface defines the term AUASB Standards. |
| Aus 16.8 | Replaces ISQM 1 paragraph 16(t) definition of ‘Relevant ethical requirements’. Relevant ethical requirements are defined in ASA 102 Compliance with Ethical Requirements when Performing Audits, Reviews and Other Assurance Engagements. |
The following application and other explanatory material is additional to or amended from ISQM 1:
| Paragraph | Summary of Change |
| Aus A9.1 | Replaces ISQM 1 paragraph A9 Glossary of terms to remove reference to the IAASB Handbook. |
| Aus A96.1 | Replaces ISQM 1 paragraph A96 to remove the reference to direct assistance of internal audit which is prohibited in Australia, consistent with ASA 610 Using the Work of Internal Auditors. |
This Auditing Standard incorporates terminology and definitions used in Australia.
Compliance with this Auditing Standard enables compliance with ISQM 1.
AUDITING STANDARD ASQM 1
Quality Management for Firms that Perform Audits or Reviews of Financial Reports and Other Financial Information, or Other Assurance or Related Services Engagements
Application
Aus 0.1 This Auditing Standard applies to a firm that performs:
(a) an audit of a financial report for a financial year, or an audit or review of a financial report for a half-year, in accordance with the Corporations Act 2001;
(b) an audit or review of a financial report, or a complete set of financial statements, for any other purpose;
(c) an audit or review of other historical financial information;
(d) an audit or review other than of historical financial information;
(e) other assurance engagements; and
(f) related services engagements.
Operative Date
Aus 0.2 Systems of quality management in compliance with this ASQM are required to be designed and implemented by 15 December 2022, and the evaluation of the system of quality management required by paragraphs 53–54 of this ASQM is required to be performed within one year following 15 December 2022.
Introduction
Scope of this Auditing Standard
This Australian Standard on Quality Management (ASQM) deals with a firm’s responsibilities to design, implement and operate a system of quality management for audits or reviews of financial reports and other financial information, or other assurance or related services engagements.
Engagement quality reviews form part of the firm’s system of quality management and:
(a)This ASQM deals with the firm’s responsibility to establish policies or procedures addressing engagements that are required to be subject to engagement quality reviews.
(b)ASQM 2[1] deals with the appointment and eligibility of the engagement quality reviewer, and the performance and documentation of the engagement quality review.
[1] See ASQM 2 Engagement Quality Reviews.
Other pronouncements of the Australian Auditing and Assurance Standards Board (AUASB):
(a)Are premised on the basis that the firm is subject to the ASQMs or to national requirements that are at least as demanding;[2] and
[2] See, for example, Australian Standard on Auditing (ASA) 220, Quality Management for an Audit of a Financial Report and Other Historical Financial Information, paragraph 3.
(b)Include requirements for engagement partners and other engagement team members regarding quality management at the engagement level. For example, ASA 220 deals with the specific responsibilities of the auditor regarding quality management at the engagement level for an audit of a financial report and the related responsibilities of the engagement partner. (Ref: Para. A1)
[Deleted by the AUASB. Refer Aus 4.1]
Aus 4.1 This ASQM is to be read in conjunction with relevant ethical requirements. Relevant ethical requirements are defined in ASA 102.* Law, regulation or relevant ethical requirements may establish responsibilities for the firm’s management of quality beyond those described in this ASQM (Ref: Para. A2).
* See ASA 102 Compliance with Ethical Requirements when Performing Audits, Reviews and Other Assurance Engagements.
Aus 4.2 This ASQM does not address the responsibilities of the firm that may exist in legislation, regulation or otherwise in connection with, for example, independence or other assurance related requirements of the Corporations Act 2001.
This ASQM applies to all firms performing audits or reviews of financial reports and other financial information, or other assurance or related services engagements (i.e., if the firm performs any of these engagements, this ASQM applies and the system of quality management that is established in accordance with the requirements of this ASQM enables the consistent performance by the firm of all such engagements).
The Firm’s System of Quality Management
A system of quality management operates in a continual and iterative manner and is responsive to changes in the nature and circumstances of the firm and its engagements. It also does not operate in a linear manner. However, for the purposes of this ASQM, a system of quality management addresses the following eight components: (Ref: Para. A3)
(a)The firm’s risk assessment process;
(b)Governance and leadership;
(c)Relevant ethical requirements;
(d)Acceptance and continuance of client relationships and specific engagements;
(e)Engagement performance;
(f)Resources;
(g)Information and communication; and
(h)The monitoring and remediation process.
This ASQM requires the firm to apply a risk-based approach in designing, implementing and operating the components of the system of quality management in an interconnected and co-ordinated manner such that the firm proactively manages the quality of engagements performed by the firm. (Ref: Para. A4)
The risk-based approach is embedded in the requirements of this ASQM through:
(a)Establishing quality objectives. The quality objectives established by the firm consist of objectives in relation to the components of the system of quality management that are to be achieved by the firm. The firm is required to establish the quality objectives specified by this ASQM and any additional quality objectives considered necessary by the firm to achieve the objectives of the system of quality management.
(b)Identifying and assessing risks to the achievement of the quality objectives (referred to in this standard as quality risks). The firm is required to identify and assess quality risks to provide a basis for the design and implementation of responses.
(c)Designing and implementing responses to address the quality risks. The nature, timing and extent of the firm’s responses to address the quality risks are based on and are responsive to the reasons for the assessments given to the quality risks.
This ASQM requires that, at least annually, the individual(s) assigned ultimate responsibility and accountability for the system of quality management, on behalf of the firm, evaluates the system of quality management and concludes whether the system of quality management provides the firm with reasonable assurance that the objectives of the system, stated in paragraph 14(a) and (b), are being achieved. (Ref: Para. A5)
Scalability
[Deleted by the AUASB. Refer Aus 10.1]
Aus 10.1 In applying a risk-based approach, the firm is required to take into account:
(a)The nature and circumstances of the firm; and
(b)The nature and circumstances of the engagements performed by the firm.
Accordingly, the design of the firm’s system of quality management, in particular the complexity and formality of the system, will vary. For example, a firm that performs different types of engagements for a wide variety of entities, including audits of financial reports of listed entities, will likely need to have a more complex and formalised system of quality management and supporting documentation, than a firm that performs only reviews of financial reports or agreed-upon procedures engagements.
Networks and Service Providers
This ASQM addresses the firm’s responsibilities when the firm:
(a)Belongs to a network, and the firm complies with network requirements or uses network services in the system of quality management or in the performance of engagements; or
(b)Uses resources from a service provider in the system of quality management or in the performance of engagements.
Even when the firm complies with network requirements or uses network services or resources from a service provider, the firm is responsible for its system of quality management.
Authority of this ASQM
Paragraph 14 contains the objective of the firm in following this ASQM. This ASQM contains: (Ref: Para. A6)
(a)Requirements designed to enable the firm to meet the objective in paragraph 14; (Ref: Para. A7)
(b)Related guidance in the form of application and other explanatory material; (Ref: Para. A8)
(c)Introductory material that provides context relevant to a proper understanding of this ASQM; and
(d)Definitions. (Ref: Para. A9)
Effective Date
[Deleted by the AUASB. Refer Aus 0.2]
Objective
The objective of the firm is to design, implement and operate a system of quality management for audits or reviews of financial reports and other financial information, or other assurance or related services engagements performed by the firm, that provides the firm with reasonable assurance that:
(a)The firm and its personnel fulfill their responsibilities in accordance with AUASB standards and applicable legal and regulatory requirements, and conduct engagements in accordance with such standards and requirements; and
(b)Engagement reports issued by the firm or engagement partners are appropriate in the circumstances.
The public interest is served by the consistent performance of quality engagements. The design, implementation and operation of the system of quality management enables the consistent performance of quality engagements by providing the firm with reasonable assurance that the objectives of the system of quality management, stated in paragraph 14(a) and (b), are achieved. Quality engagements are achieved through planning and performing engagements and reporting on them in accordance with AUASB standards and applicable legal and regulatory requirements. Achieving the objectives of those standards and complying with the requirements of applicable law or regulation involves exercising professional judgement and, when applicable to the type of engagement, exercising professional scepticism.
Definitions
For purposes of this ASQM, the following terms have the meanings attributed below:
Aus 16.1 Assurance engagement means an engagement in which an assurance practitioner expresses a conclusion designed to enhance the degree of confidence of the intended users, other than the responsible party, about the outcome of the evaluation or measurement of a subject matter against criteria.
Aus 16.2 Assurance practitioner means an individual, firm, or other organisation, whether in public practice, industry and commerce, or the public sector conducting assurance engagements, or related services engagements (including engagements to perform agreed-upon procedures). The term ‘assurance practitioner’ is referred to in ASRS 4400 as ‘practitioner’.
Aus 16.3 Date of report means the date the assurance practitioner signs the report.
(a)Deficiency in the firm’s system of quality management (referred to as “deficiency” in this ASQM) – This exists when: (Ref: Para. A10, A159–A160)
(i)A quality objective required to achieve the objective of the system of quality management is not established;
(ii)A quality risk, or combination of quality risks, is not identified or properly assessed; (Ref: Para. A11)
(iii)A response, or combination of responses, does not reduce to an acceptably low level the likelihood of a related quality risk occurring because the response(s) is not properly designed, implemented or operating effectively; or
(iv)An other aspect of the system of quality management is absent, or not properly designed, implemented or operating effectively, such that a requirement of this ASQM has not been addressed. (Ref: Para. A12)
(b)Engagement documentation – The record of work performed, results obtained, and conclusions the practitioner reached (terms such as “working papers” or “work papers” are sometimes used).
(c)Engagement partner[3] – The partner or other individual, appointed by the firm, who is responsible for the engagement and its performance, and for the report that is issued on behalf of the firm, and who, where required, has the appropriate authority from a professional, legal or regulatory body.
[3] “Engagement partner” and “partner” is to be read as referring to their public sector equivalents where relevant.
(d)Engagement quality review – An objective evaluation of the significant judgements made by the engagement team and the conclusions reached thereon, performed by the engagement quality reviewer and completed on or before the date of the engagement report.
(e)Engagement quality reviewer – A partner, other individual in the firm, or an external individual, appointed by the firm to perform the engagement quality review.
(f)[Deleted by the AUASB. Refer Aus 16.4]
Aus 16.4 Engagement team – All partners and staff performing the engagement, and any other individuals who perform procedures on the engagement, excluding an external expert[4]. (Ref: Para. A13)
[4] See ASA 620 Using the Work of an Auditor’s Expert, paragraph 6(a), defines the term “auditor’s expert”.
(g)External inspections – Inspections or investigations, undertaken by an external oversight authority, related to the firm’s system of quality management or engagements performed by the firm. (Ref: Para. A14)
(h)Findings (in relation to a system of quality management) – Information about the design, implementation and operation of the system of quality management that has been accumulated from the performance of monitoring activities, external inspections and other relevant sources, which indicates that one or more deficiencies may exist. (Ref: Para. A15–A17)
(i)Firm – A sole practitioner, partnership or corporation or other entity of assurance practitioners, or public sector equivalent. (Ref: Para. A18)
(j)Listed entity – An entity whose shares, stock or debt are quoted or listed on a recognised stock exchange, or are marketed under the regulations of a recognised stock exchange or other equivalent body.
(k)Network firm – A firm or entity that belongs to the firm’s network.
(l)Network – A larger structure: (Ref: Para. A19)
(i)That is aimed at cooperation; and
(ii)That is clearly aimed at profit or cost-sharing or shares common ownership, control or management, common quality management policies or procedures, common business strategy, the use of a common brand name, or a significant part of professional resources.
Aus 16.5 Other financial information means historical financial information and information other than historical financial information (for example, prospective financial information).
(m)[Deleted by the AUASB. Refer Aus 16.6]
Aus 16.6 Partner means any individual with authority to bind the firm with respect to the performance of an audit, review, other assurance engagement or related services engagement.
(n)Personnel – Partners and staff in the firm. (Ref: Para. A20–A21)
(o)Professional judgement – The application of relevant training, knowledge and experience, within the context of AUASB standards, in making informed decisions about the courses of action that are appropriate in the design, implementation and operation of the firm’s system of quality management.
(p)[Deleted by the AUASB. Refer Aus 16.7]
Aus 16.7 AUASB Standards means standards issued by the AUASB, comprising:
(a)Australian Auditing Standards, which means the suite of auditing standards issued by the AUASB, comprising:
·Auditing Standards made under section 336 of the Corporations Act 2001;
·ASA 805 Special Considerations—Audits of Single Financial Statements and Specific Elements, Accounts or Items of a Financial Statement; and
·ASA 810 Engagements to Report on Summary Financial Statements.
(b)Standards on Review Engagements;
(c)Standards on Assurance Engagements; and
(d)Standards on Related Services.
(q)Quality objectives – The desired outcomes in relation to the components of the system of quality management to be achieved by the firm.
(r)Quality risk – A risk that has a reasonable possibility of:
(i)Occurring; and
(ii)Individually, or in combination with other risks, adversely affecting the achievement of one or more quality objectives.
(s)Reasonable assurance – In the context of the ASQMs, a high, but not absolute, level of assurance.
(t)[Deleted by the AUASB. Refer Aus 16.8]
Aus 16.8 Relevant ethical requirements means relevant ethical requirements as defined in ASA 102 Compliance with Ethical Requirements when Performing Audits, Reviews and Other Assurance Engagements. (Ref: Para. A22-A24; A62)
(u)Response (in relation to a system of quality management) – Policies or procedures designed and implemented by the firm to address one or more quality risk(s): (Ref: Para. A25–A27, A50)
(i)Policies are statements of what should, or should not, be done to address a quality risk(s). Such statements may be documented, explicitly stated in communications or implied through actions and decisions.
(ii)Procedures are actions to implement policies.
(v)Service provider (in the context of this ASQM) – An individual or organisation external to the firm that provides a resource that is used in the system of quality management or in the performance of engagements. Service providers exclude the firm’s network, other network firms or other structures or organisations in the network. (Ref: Para. A28, A105)
(w)Staff – Professionals, other than partners, including any experts the firm employs.
(x)System of quality management – A system designed, implemented and operated by a firm to provide the firm with reasonable assurance that:
(i)The firm and its personnel fulfill their responsibilities in accordance with AUASB standards and applicable legal and regulatory requirements, and conduct engagements in accordance with such standards and requirements; and
(ii)Engagement reports issued by the firm or engagement partners are appropriate in the circumstances.
Requirements
Applying, and Complying with, Relevant Requirements
The firm shall comply with each requirement of this ASQM unless the requirement is not relevant to the firm because of the nature and circumstances of the firm or its engagements. (Ref: Para. A29)
The individual(s) assigned ultimate responsibility and accountability for the firm’s system of quality management, and the individual(s) assigned operational responsibility for the firm’s system of quality management shall have an understanding of this ASQM, including the application and other explanatory material, to understand the objective of this ASQM and to apply its requirements properly.
System of Quality Management
The firm shall design, implement and operate a system of quality management. In doing so, the firm shall exercise professional judgement, taking into account the nature and circumstances of the firm and its engagements. The governance and leadership component of the system of quality management establishes the environment that supports the design, implementation and operation of the system of quality management. (Ref: Para. A30–A31)
Responsibilities
The firm shall assign: (Ref: Para. A32–A35)
(a)Ultimate responsibility and accountability for the system of quality management to the firm’s chief executive officer or the firm’s managing partner (or equivalent) or, if appropriate, the firm’s managing board of partners (or equivalent);
(b)Operational responsibility for the system of quality management;
(c)Operational responsibility for specific aspects of the system of quality management, including:
(i)Compliance with independence requirements; and (Ref: Para. A36)
(ii)The monitoring and remediation process.
In assigning the roles in paragraph 20 the firm shall determine that the individual(s): (Ref: Para. A37)
(a)Has the appropriate experience, knowledge, influence and authority within the firm, and sufficient time, to fulfill their assigned responsibility; and (Ref: Para. A38)
(b)Understands their assigned roles and that they are accountable for fulfilling them.
The firm shall determine that the individual(s) assigned operational responsibility for the system of quality management, compliance with independence requirements and the monitoring and remediation process, have a direct line of communication to the individual(s) assigned ultimate responsibility and accountability for the system of quality management.
The Firm’s Risk Assessment Process
The firm shall design and implement a risk assessment process to establish quality objectives, identify and assess quality risks and design and implement responses to address the quality risks. (Ref: Para. A39–A41)
The firm shall establish the quality objectives specified by this ASQM and any additional quality objectives considered necessary by the firm to achieve the objectives of the system of quality management. (Ref: Para. A42–A44)
The firm shall identify and assess quality risks to provide a basis for the design and implementation of responses. In doing so, the firm shall:
(a)Obtain an understanding of the conditions, events, circumstances, actions or inactions that may adversely affect the achievement of the quality objectives, including: (Ref: Para. A45–A47)
(i)With respect to the nature and circumstances of the firm, those relating to:
a.The complexity and operating characteristics of the firm;
b.The strategic and operational decisions and actions, business processes and business model of the firm;
c.The characteristics and management style of leadership;
d.The resources of the firm, including the resources provided by service providers;
e.Law, regulation, AUASB standards and the environment in which the firm operates; and
f.In the case of a firm that belongs to a network, the nature and extent of the network requirements and network services, if any.
(ii)With respect to the nature and circumstances of the engagements performed by the firm, those relating to:
a.The types of engagements performed by the firm and the reports to be issued; and
b.The types of entities for which such engagements are undertaken.
(b)Take into account how, and the degree to which, the conditions, events, circumstances, actions or inactions in paragraph 25(a) may adversely affect the achievement of the quality objectives. (Ref: Para. A48)
The firm shall design and implement responses to address the quality risks in a manner that is based on, and responsive to, the reasons for the assessments given to the quality risks. The firm’s responses shall also include the responses specified in paragraph 34. (Ref: Para. A49–A51)
The firm shall establish policies or procedures that are designed to identify information that indicates additional quality objectives, or additional or modified quality risks or responses, are needed due to changes in the nature and circumstances of the firm or its engagements. If such information is identified, the firm shall consider the information and when appropriate: (Ref: Para. A52–A53)
(a)Establish additional quality objectives or modify additional quality objectives already established by the firm; (Ref: Para. A54)
(b)Identify and assess additional quality risks, modify the quality risks or reassess the quality risks; or
(c)Design and implement additional responses, or modify the responses.
Governance and Leadership
The firm shall establish the following quality objectives that address the firm’s governance and leadership, which establishes the environment that supports the system of quality management:
(a)The firm demonstrates a commitment to quality through a culture that exists throughout the firm, which recognises and reinforces: (Ref: Para. A55–A56)
(i)The firm’s role in serving the public interest by consistently performing quality engagements;
(ii)The importance of professional ethics, values and attitudes;
(iii)The responsibility of all personnel for quality relating to the performance of engagements or activities within the system of quality management, and their expected behaviour; and
(iv)The importance of quality in the firm’s strategic decisions and actions, including the firm’s financial and operational priorities.
(b)Leadership is responsible and accountable for quality. (Ref: Para. A57)
(c)Leadership demonstrates a commitment to quality through their actions and behaviours. (Ref: Para. A58)
(d)The organisational structure and assignment of roles, responsibilities and authority is appropriate to enable the design, implementation and operation of the firm’s system of quality management. (Ref: Para. A32, A33, A35, A59)
(e)Resource needs, including financial resources, are planned for and resources are obtained, allocated or assigned in a manner that is consistent with the firm’s commitment to quality. (Ref: Para. A60–A61)
Relevant Ethical Requirements
The firm shall establish the following quality objectives that address the fulfillment of responsibilities in accordance with relevant ethical requirements, including those related to independence: (Ref: Para. A62–A64, A66)
(a)The firm and its personnel:
(i)Understand the relevant ethical requirements to which the firm and the firm’s engagements are subject; and (Ref: Para. A22, A24)
(ii)Fulfill their responsibilities in relation to the relevant ethical requirements to which the firm and the firm’s engagements are subject.
(b)Others, including the network, network firms, individuals in the network or network firms, or service providers, who are subject to the relevant ethical requirements to which the firm and the firm’s engagements are subject:
(i)Understand the relevant ethical requirements that apply to them; and (Ref: Para. A22, A24, A65)
(ii)Fulfill their responsibilities in relation to the relevant ethical requirements that apply to them.
Acceptance and Continuance of Client Relationships and Specific Engagements
The firm shall establish the following quality objectives that address the acceptance and continuance of client relationships and specific engagements:
(a)Judgements by the firm about whether to accept or continue a client relationship or specific engagement are appropriate based on:
(i)Information obtained about the nature and circumstances of the engagement and the integrity and ethical values of the client (including management, and, when appropriate, those charged with governance) that is sufficient to support such judgements; and (Ref: Para. A67–A71)
(ii)The firm’s ability to perform the engagement in accordance with AUASB standards and applicable legal and regulatory requirements. (Ref: Para. A72)
(b)The financial and operational priorities of the firm do not lead to inappropriate judgements about whether to accept or continue a client relationship or specific engagement. (Ref: Para. A73–A74)
Engagement Performance
The firm shall establish the following quality objectives that address the performance of quality engagements:
(a)Engagement teams understand and fulfill their responsibilities in connection with the engagements, including, as applicable, the overall responsibility of engagement partners for managing and achieving quality on the engagement and being sufficiently and appropriately involved throughout the engagement. (Ref: Para. A75)
(b)The nature, timing and extent of direction and supervision of engagement teams and review of the work performed is appropriate based on the nature and circumstances of the engagements and the resources assigned or made available to the engagement teams, and the work performed by less experienced engagement team members is directed, supervised and reviewed by more experienced engagement team members. (Ref: Para. A76–A77)
(c)Engagement teams exercise appropriate professional judgement and, when applicable to the type of engagement, professional scepticism. (Ref: Para. A78)
(d)Consultation on difficult or contentious matters is undertaken and the conclusions agreed are implemented. (Ref: Para. A79–A81)
(e)Differences of opinion within the engagement team, or between the engagement team and the engagement quality reviewer or individuals performing activities within the firm’s system of quality management are brought to the attention of the firm and resolved. (Ref: Para. A82)
(f)Engagement documentation is assembled on a timely basis after the date of the engagement report, and is appropriately maintained and retained to meet the needs of the firm and comply with law, regulation, relevant ethical requirements, or AUASB standards. (Ref: Para. A83–A85)
Resources
The firm shall establish the following quality objectives that address appropriately obtaining, developing, using, maintaining, allocating and assigning resources in a timely manner to enable the design, implementation and operation of the system of quality management: (Ref: Para. A86–A87)
Human Resources
(a)Personnel are hired, developed and retained and have the competence and capabilities to: (Ref: Para. A88–A90)
(i)Consistently perform quality engagements, including having knowledge or experience relevant to the engagements the firm performs; or
(ii)Perform activities or carry out responsibilities in relation to the operation of the firm’s system of quality management.
(b)Personnel demonstrate a commitment to quality through their actions and behaviours, develop and maintain the appropriate competence to perform their roles, and are held accountable or recognised through timely evaluations, compensation, promotion and other incentives. (Ref: Para. A91–A93)
(c)Individuals are obtained from external sources (i.e., the network, another network firm or a service provider) when the firm does not have sufficient or appropriate personnel to enable the operation of firm’s system of quality management or performance of engagements. (Ref: Para. A94)
(d)Engagement team members are assigned to each engagement, including an engagement partner, who have appropriate competence and capabilities, including being given sufficient time, to consistently perform quality engagements. (Ref: Para. A88–A89, A95–A97)
(e)Individuals are assigned to perform activities within the system of quality management who have appropriate competence and capabilities, including sufficient time, to perform such activities.
Technological Resources
(f)Appropriate technological resources are obtained or developed, implemented, maintained, and used, to enable the operation of the firm’s system of quality management and the performance of engagements. (Ref: Para. A98–A101, A104)
Intellectual Resources
(g)Appropriate intellectual resources are obtained or developed, implemented, maintained, and used, to enable the operation of the firm’s system of quality management and the consistent performance of quality engagements, and such intellectual resources are consistent with AUASB standards and applicable legal and regulatory requirements, where applicable. (Ref: Para. A102–A104)
Service Providers
(h)Human, technological or intellectual resources from service providers are appropriate for use in the firm’s system of quality management and in the performance of engagements, taking into account the quality objectives in paragraph 32 (d),(e),(f) and (g). (Ref: Para. A105–A108)
Information and Communication
The firm shall establish the following quality objectives that address obtaining, generating or using information regarding the system of quality management, and communicating information within the firm and to external parties on a timely basis to enable the design, implementation and operation of the system of quality management: (Ref: Para. A109)
(a)The information system identifies, captures, processes and maintains relevant and reliable information that supports the system of quality management, whether from internal or external sources. (Ref: Para. A110–A111)
(b)The culture of the firm recognises and reinforces the responsibility of personnel to exchange information with the firm and with one another. (Ref: Para. A112)
(c)Relevant and reliable information is exchanged throughout the firm and with engagement teams, including: (Ref: Para. A112)
(i)Information is communicated to personnel and engagement teams, and the nature, timing and extent of the information is sufficient to enable them to understand and carry out their responsibilities relating to performing activities within the system of quality management or engagements; and
(ii)Personnel and engagement teams communicate information to the firm when performing activities within the system of quality management or engagements.
(d)Relevant and reliable information is communicated to external parties, including:
(i)Information is communicated by the firm to or within the firm’s network or to service providers, if any, enabling the network or service providers to fulfill their responsibilities relating to the network requirements or network services or resources provided by them; and (Ref: Para. A113)
(ii)Information is communicated externally when required by law, regulation or AUASB standards, or to support external parties’ understanding of the system of quality management. (Ref: Para. A114–A115)
Specified Responses
In designing and implementing responses in accordance with paragraph 26, the firm shall include the following responses: (Ref: Para. A116)
(a)The firm establishes policies or procedures for:
(i)Identifying, evaluating and addressing threats to compliance with the relevant ethical requirements; and (Ref: Para. A117)
(ii)Identifying, communicating, evaluating and reporting of any breaches of the relevant ethical requirements and appropriately responding to the causes and consequences of the breaches in a timely manner. (Ref: Para. A118–A119)
(b)The firm obtains, at least annually, a documented confirmation of compliance with independence requirements from all personnel required by relevant ethical requirements to be independent.
(c)The firm establishes policies or procedures for receiving, investigating and resolving complaints and allegations about failures to perform work in accordance with AUASB standards and applicable legal and regulatory requirements, or non-compliance with the firm’s policies or procedures established in accordance with this ASQM. (Ref: Para. A120–A121)
(d)The firm establishes policies or procedures that address circumstances when:
(i)The firm becomes aware of information subsequent to accepting or continuing a client relationship or specific engagement that would have caused it to decline the client relationship or specific engagement had that information been known prior to accepting or continuing the client relationship or specific engagement; or (Ref: Para. A122–A123)
(ii)The firm is obligated by law or regulation to accept a client relationship or specific engagement. (Ref: Para. A123)
(e)The firm establishes policies or procedures that: (Ref: Para. A124–A126)
(i)Require communication with those charged with governance when performing an audit of a financial report of listed entities about how the system of quality management supports the consistent performance of quality audit engagements; (Ref: Para. A127–A129)
(ii)Address when it is otherwise appropriate to communicate with external parties about the firm’s system of quality management; and (Ref: Para. A130)
(iii)Address the information to be provided when communicating externally in accordance with paragraphs 34(e)(i) and 34(e)(ii), including the nature, timing and extent and appropriate form of communication. (Ref: Para. A131–A132)
(f)The firm establishes policies or procedures that address engagement quality reviews in accordance with ASQM 2, and require an engagement quality review for:
(i)Audits of financial reports of listed entities;
(ii)Audits or other engagements for which an engagement quality review is required by law or regulation; and (Ref: Para. A133)
(iii)Audits or other engagements for which the firm determines that an engagement quality review is an appropriate response to address one or more quality risk(s). (Ref: Para. A134-A137)
Monitoring and Remediation Process
The firm shall establish a monitoring and remediation process to: (Ref: Para. A138)
(a)Provide relevant, reliable and timely information about the design, implementation and operation of the system of quality management.
(b)Take appropriate actions to respond to identified deficiencies such that deficiencies are remediated on a timely basis.
Designing and Performing Monitoring Activities
The firm shall design and perform monitoring activities to provide a basis for the identification of deficiencies.
In determining the nature, timing and extent of the monitoring activities, the firm shall take into account: (Ref: Para. A139–A142)
(a)The reasons for the assessments given to the quality risks;
(b)The design of the responses;
(c)The design of the firm’s risk assessment process and monitoring and remediation process; (Ref: Para. A143–A144)
(d)Changes in the system of quality management; (Ref: Para. A145)
(e)The results of previous monitoring activities, whether previous monitoring activities continue to be relevant in evaluating the firm’s system of quality management and whether remedial actions to address previously identified deficiencies were effective; and (Ref: Para. A146–A147)
(f)Other relevant information, including complaints and allegations about failures to perform work in accordance with AUASB standards and applicable legal and regulatory requirements or non-compliance with the firm’s policies or procedures established in accordance with this ASQM, information from external inspections and information from service providers. (Ref: Para. A148–A150)
The firm shall include the inspection of completed engagements in its monitoring activities and shall determine which engagements and engagement partners to select. In doing so, the firm shall: (Ref: Para. A141, A151–A154)
(a)Take into account the matters in paragraph 37;
(b)Consider the nature, timing and extent of other monitoring activities undertaken by the firm and the engagements and engagement partners subject to such monitoring activities; and
(c)Select at least one completed engagement for each engagement partner on a cyclical basis determined by the firm.
The firm shall establish policies or procedures that:
(a)Require the individuals performing the monitoring activities to have the competence and capabilities, including sufficient time, to perform the monitoring activities effectively; and
(b)Address the objectivity of the individuals performing the monitoring activities. Such policies or procedures shall prohibit the engagement team members or the engagement quality reviewer of an engagement from performing any inspection of that engagement. (Ref: Para. A155–A156)
Evaluating Findings and Identifying Deficiencies
The firm shall evaluate findings to determine whether deficiencies exist, including in the monitoring and remediation process. (Ref: Para. A157–A162)
Evaluating Identified Deficiencies
The firm shall evaluate the severity and pervasiveness of identified deficiencies by: (Ref: Para. A161, A163–A164)
(a)Investigating the root cause(s) of the identified deficiencies. In determining the nature, timing and extent of the procedures to investigate the root cause(s), the firm shall take into account the nature of the identified deficiencies and their possible severity. (Ref: Para. A165–A169)
(b)Evaluating the effect of the identified deficiencies, individually and in aggregate, on the system of quality management.
Responding to Identified Deficiencies
The firm shall design and implement remedial actions to address identified deficiencies that are responsive to the results of the root cause analysis. (Ref: Para. A170–A172)
The individual(s) assigned operational responsibility for the monitoring and remediation process shall evaluate whether the remedial actions:
(a)Are appropriately designed to address the identified deficiencies and their related root cause(s) and determine that they have been implemented; and
(b)Implemented to address previously identified deficiencies are effective.
If the evaluation indicates that the remedial actions are not appropriately designed and implemented or are not effective, the individual(s) assigned operational responsibility for the monitoring and remediation process shall take appropriate action to determine that the remedial actions are appropriately modified such that they are effective.
Findings About a Particular Engagement
The firm shall respond to circumstances when findings indicate that there is an engagement(s) for which procedures required were omitted during the performance of the engagement(s) or the report issued may be inappropriate. The firm’s response shall include: (Ref: Para. A173)
(a)Taking appropriate action to comply with relevant AUASB standards and applicable legal and regulatory requirements; and
(b)When the report is considered to be inappropriate, considering the implications and taking appropriate action, including considering whether to obtain legal advice.
Ongoing Communication Related to Monitoring and Remediation
The individual(s) assigned operational responsibility for the monitoring and remediation process shall communicate on a timely basis to the individual(s) assigned ultimate responsibility and accountability for the system of quality management and the individual(s) assigned operational responsibility for the system of quality management: (Ref: Para. A174)
(a)A description of the monitoring activities performed;
(b)The identified deficiencies, including the severity and pervasiveness of such deficiencies; and
(c)The remedial actions to address the identified deficiencies.
The firm shall communicate the matters described in paragraph 46 to engagement teams and other individuals assigned activities within the system of quality management to enable them to take prompt and appropriate action in accordance with their responsibilities.
Network Requirements or Network Services
When the firm belongs to a network, the firm shall understand, when applicable: (Ref: Para. A19, A175)
(a)The requirements established by the network regarding the firm’s system of quality management, including requirements for the firm to implement or use resources or services designed or otherwise provided by or through the network (i.e., network requirements);
(b)Any services or resources provided by the network that the firm chooses to implement or use in the design, implementation or operation of the firm’s system of quality management (i.e., network services); and
(c)The firm’s responsibilities for any actions that are necessary to implement the network requirements or use network services. (Ref: Para. A176)
The firm remains responsible for its system of quality management, including professional judgements made in the design, implementation and operation of the system of quality management. The firm shall not allow compliance with the network requirements or use of network services to contravene the requirements of this ASQM. (Ref: Para. A177)
Based on the understanding obtained in paragraph 48, the firm shall:
(a)Determine how the network requirements or network services are relevant to, and are taken into account in, the firm’s system of quality management, including how they are to be implemented; and (Ref: Para. A178)
(b)Evaluate whether and, if so, how the network requirements or network services need to be adapted or supplemented by the firm to be appropriate for use in its system of quality management. (Ref: Para. A179–A180)
Monitoring Activities Undertaken by the Network on the Firm’s System of Quality Management
In circumstances when the network performs monitoring activities relating to the firm’s system of quality management, the firm shall:
(a)Determine the effect of the monitoring activities performed by the network on the nature, timing and extent of the firm’s monitoring activities performed in accordance with paragraphs 36–38;
(b)Determine the firm’s responsibilities in relation to the monitoring activities, including any related actions by the firm; and
(c)As part of evaluating findings and identifying deficiencies in paragraph 40, obtain the results of the monitoring activities from the network in a timely manner. (Ref: Para. A181)
Monitoring Activities Undertaken by the Network Across the Network Firms
The firm shall:
(a)Understand the overall scope of the monitoring activities undertaken by the network across the network firms, including monitoring activities to determine that network requirements have been appropriately implemented across the network firms, and how the network will communicate the results of its monitoring activities to the firm;
(b)At least annually, obtain information from the network about the overall results of the network’s monitoring activities across the network firms, if applicable, and: (Ref: Para. A182–A184)
(i)Communicate the information to engagement teams and other individuals assigned activities within the system of quality management, as appropriate, to enable them to take prompt and appropriate action in accordance with their responsibilities; and
(ii)Consider the effect of the information on the firm’s system of quality management.
Deficiencies in Network Requirements or Network Services Identified by the Firm
If the firm identifies a deficiency in the network requirements or network services, the firm shall: (Ref: Para. A185)
(a)Communicate to the network relevant information about the identified deficiency; and
(b)In accordance with paragraph 42, design and implement remedial actions to address the effect of the identified deficiency in the network requirements or network services. (Ref: Para. A186)
Evaluating the System of Quality Management
The individual(s) assigned ultimate responsibility and accountability for the system of quality management shall evaluate, on behalf of the firm, the system of quality management. The evaluation shall be undertaken as of a point in time, and performed at least annually. (Ref: Para. A187–A189)
Based on the evaluation, the individual(s) assigned ultimate responsibility and accountability for the system of quality management shall conclude, on behalf of the firm, one of the following: (Ref: Para. A190, A195)
(a)The system of quality management provides the firm with reasonable assurance that the objectives of the system of quality management are being achieved; (Ref: Para. A191)
(b)Except for matters related to identified deficiencies that have a severe but not pervasive effect on the design, implementation and operation of the system of quality management, the system of quality management provides the firm with reasonable assurance that the objectives of the system of quality management are being achieved; or (Ref: Para. A192)
(c)The system of quality management does not provide the firm with reasonable assurance that the objectives of the system of quality management are being achieved. (Ref: Para. A192–A194)
If the individual(s) assigned ultimate responsibility and accountability for the system of quality management reaches the conclusion described in paragraph 54(b) or 54(c), the firm shall: (Ref: Para. A196)
(a)Take prompt and appropriate action; and
(b)Communicate to:
(i)Engagement teams and other individuals assigned activities within the system of quality management to the extent that it is relevant to their responsibilities; and (Ref: Para. A197)
(ii)External parties in accordance with the firm’s policies or procedures required by paragraph 34(e). (Ref: Para. A198)
The firm shall undertake periodic performance evaluations of the individual(s) assigned ultimate responsibility and accountability for the system of quality management, and the individual(s) assigned operational responsibility for the system of quality management. In doing so, the firm shall take into account the evaluation of the system of quality management. (Ref: Para. A199–A201)
Documentation
The firm shall prepare documentation of its system of quality management that is sufficient to: (Ref: Para. A202–A204)
(a)Support a consistent understanding of the system of quality management by personnel, including an understanding of their roles and responsibilities with respect to the system of quality management and the performance of engagements;
(b)Support the consistent implementation and operation of the responses; and
(c)Provide evidence of the design, implementation and operation of the responses, to support the evaluation of the system of quality management by the individual(s) assigned ultimate responsibility and accountability for the system of quality management.
In preparing documentation, the firm shall include:
(a)The identification of the individual(s) assigned ultimate responsibility and accountability for the system of quality management and operational responsibility for the system of quality management;
(b)The firm’s quality objectives and quality risks; (Ref: Para. A205)
(c)A description of the responses and how the firm’s responses address the quality risks;
(d)Regarding the monitoring and remediation process:
(i)Evidence of the monitoring activities performed;
(ii)The evaluation of findings, and identified deficiencies and their related root cause(s);
(iii)Remedial actions to address identified deficiencies and the evaluation of the design and implementation of such remedial actions; and
(iv)Communications about monitoring and remediation; and
(e)The basis for the conclusion reached pursuant to paragraph 54.
The firm shall document the matters in paragraph 58 as they relate to network requirements or network services and the evaluation of the network requirements or network services in accordance with paragraph 49(b). (Ref: Para. A206)
The firm shall establish a period of time for the retention of documentation for the system of quality management that is sufficient to enable the firm to monitor the design, implementation and operation of the firm’s system of quality management, or for a longer period if required by law or regulation.
* * *
Application and Other Explanatory Material
Scope of this ASQM (Ref: Para. 3–4)
A1.Other pronouncements of the AUASB, including ASRE 2400[5] and ASAE 3000,[6] also establish requirements for the engagement partner for the management of quality at the engagement level.
[5] See Australian Standard on Review Engagements (ASRE) 2400 Review of a Financial Report Performed by an Assurance Practitioner Who is Not the Auditor of the Entity.
[6] See Australian Standard on Assurance Engagements (ASAE) 3000, Assurance Engagements Other than Audits or Reviews of Historical Financial Information.
A2.The APESB Code[7] contains requirements and application material for members that enable members to meet their responsibility to act in the public interest. As indicated in paragraph 15, in the context of engagement performance as described in this ASQM, the consistent performance of quality engagements forms part of the member’s responsibility to act in the public interest.
[7] See The Accounting Professional & Ethical Standards Board’s APES 110 Code of Ethics for Professional Accountants (including Independence Standards) (APESB Code).
The Firm’s System of Quality Management (Ref: Para. 6–9)
A3.The firm may use different terminology or frameworks to describe the components of its system of quality management.
A4.Examples of the interconnected nature of the components include the following:
·The firm’s risk assessment process sets out the process the firm is required to follow in implementing a risk-based approach across the system of quality management.
·The governance and leadership component establishes the environment that supports the system of quality management.
·The resources and information and communication components enable the design, implementation and operation of the system of quality management.
·The monitoring and remediation process is a process designed to monitor the entire system of quality management. The results of the monitoring and remediation process provide information that is relevant to the firm’s risk assessment process.
·There may be relationships between specific matters, for example, certain aspects of relevant ethical requirements are relevant to accepting and continuing client relationships and specific engagements.
A5.Reasonable assurance is obtained when the system of quality management reduces to an acceptably low level the risk that the objectives stated in paragraph 14(a) and (b) are not achieved. Reasonable assurance is not an absolute level of assurance, because there are inherent limitations of a system of quality management. Such limitations include that human judgement in decision making can be faulty and that breakdowns in a firm’s system of quality management may occur, for example, due to human error or behaviour or failures in information technology (IT) applications.
Authority of this ASQM (Ref: Para. 12)
A6.The objective of this ASQM provides the context in which the requirements of this ASQM are set, establishes the desired outcome of this ASQM and is intended to assist the firm in understanding what needs to be accomplished and, where necessary, the appropriate means of doing so.
A7.The requirements of this ASQM are expressed using “shall.”
A8.Where necessary, the application and other explanatory material provides further explanation of the requirements and guidance for carrying them out. In particular, it may:
·Explain more precisely what a requirement means or is intended to cover; and
·Include examples that illustrate how the requirements might be applied.
While such guidance does not in itself impose a requirement, it is relevant to the proper application of the requirements. The application and other explanatory material may also provide background information on matters addressed in this ASQM. Where appropriate, additional considerations specific to public sector audit organisations are included within the application and other explanatory material. These additional considerations assist in the application of the requirements in this ASQM. They do not, however, limit or reduce the responsibility of the firm to apply and comply with the requirements in this ASQM.
A9.[Deleted by the AUASB. Refer Aus A9.1]
Aus A9.1 This ASQM includes, under the heading “Definitions,” a description of the meanings attributed to certain terms for purposes of this ASQM. These definitions are provided to assist in the consistent application and interpretation of this ASQM, and are not intended to override definitions that may be established for other purposes, whether in law, regulation or otherwise. The Glossary of Terms relating to AUASB Standards issued by the AUASB includes the terms defined in this ASQM. The Glossary of Terms also includes descriptions of other terms found in the ASQMs to assist in common and consistent interpretation and translation.
Definitions
Deficiency (Ref: Para. 16(a))
A10.The firm identifies deficiencies through evaluating findings. A deficiency may arise from a finding, or a combination of findings.
A11.When a deficiency is identified as a result of a quality risk, or combination of quality risks, not being identified or properly assessed, the response(s) to address such quality risk(s) may also be absent, or not appropriately designed or implemented.
A12.The other aspects of the system of quality management consist of the requirements in this ASQM addressing:
·Assigning responsibilities (paragraphs 20–22);
·The firm’s risk assessment process;
·The monitoring and remediation process; and
·The evaluation of the system of quality management.
Examples of deficiencies related to other aspects of the system of quality management
· The firm’s risk assessment process fails to identify information that indicates changes in the nature and circumstances of the firm and its engagements and the need to establish additional quality objectives, or modify the quality risks or responses.
· The firm’s monitoring and remediation process is not designed or implemented in a manner that:
o Provides relevant, reliable and timely information about the design, implementation and operation of the system of quality management.
o Enables the firm to take appropriate actions to respond to identified deficiencies such that deficiencies are remediated on a timely basis.
· The individual(s) assigned ultimate responsibility and accountability for the system of quality management does not undertake the annual evaluation of the system of quality management.
Engagement Team (Ref: Para. Aus 16.4)
A13.ASA 220[8] provides guidance in applying the definition of engagement team in the context of an audit of a financial report.
[8] See ASA 220, paragraphs A15–A25.
External Inspections (Ref: Para. 16(g))
A14.In some circumstances, an external oversight authority may undertake other types of inspections, for example, thematic reviews that focus on, for a selection of firms, particular aspects of audit engagements or firm-wide practices.
Findings (Ref: Para. 16(h))
A15.As part of accumulating findings from monitoring activities, external inspections and other relevant sources, the firm may identify other observations about the firm’s system of quality management, such as positive outcomes or opportunities for the firm to improve, or further enhance, the system of quality management. Paragraph A158 explains how other observations may be used by the firm in the system of quality management.
A16.Paragraph A148 provides examples of information from other relevant sources.
A17.Monitoring activities include monitoring at the engagement level, such as inspection of engagements. Furthermore, external inspections and other relevant sources may include information that relates to specific engagements. As a result, information about the design, implementation and operation of the system of quality management includes engagement-level findings that may be indicative of findings in relation to the system of quality management.
Firm (Ref: Para. 16(i))
A18.The definition of “firm” in relevant ethical requirements may differ from the definition set out in this ASQM.
Network (Ref: Para. 16(l), 48)
A19.Networks and the firms within the network may be structured in a variety of ways. For example, in the context of a firm’s system of quality management:
·The network may establish requirements for the firm related to its system of quality management, or provide services that are used by the firm in its system of quality management or in the performance of engagements;
·Other firms within the network may provide services (e.g., resources) that are used by the firm in its system of quality management or in the performance of engagements; or
·Other structures or organisations within the network may establish requirements for the firm related to its system of quality management, or provide services.
For the purposes of this ASQM, any network requirements or network services that are obtained from the network, another firm within the network or another structure or organisation in the network are considered “network requirements or network services.”
Personnel (Ref: Para. 16(n))
A20.In addition to personnel (i.e., individuals in the firm), the firm may use individuals external to the firm in performing activities in the system of quality management or in the performance of engagements. For example, individuals external to the firm may include individuals from other network firms (e.g., individuals in a service delivery centre of a network firm) or individuals employed by a service provider (e.g., a component auditor from another firm not within the firm’s network).
A21.Personnel also includes partners and staff in other structures of the firm, such as a service delivery centre in the firm.
Relevant Ethical Requirements (Ref: Para. Aus 16.8, 29)
A22.The relevant ethical requirements that are applicable in the context of a system of quality management may vary, depending on the nature and circumstances of the firm and its engagements. The term “member” may be defined in relevant ethical requirements. For example, the APESB Code defines the term “member” and further explains the scope of provisions in the APESB Code that apply to individual members in public practice and their firms.
A23.The APESB Code addresses circumstances when law or regulation precludes the member from complying with certain parts of the APESB Code. It further acknowledges that some jurisdictions might have provisions in law or regulation that differ from or go beyond those set out in the APESB Code and that members in those jurisdictions need to be aware of those differences and comply with the more stringent provisions, unless prohibited by law or regulation.
A24.Various provisions of the relevant ethical requirements may apply only to individuals in the context of the performance of engagements and not the firm itself. For example:
·Part 2 of the APESB Code applies to individuals who are members in public practice when they are performing professional activities pursuant to their relationship with the firm, whether as a contractor, employee or owner, and may be relevant in the context of the performance of engagements.
·Certain requirements in Parts 3 and 4 of the APESB Code also apply to individuals who are members in public practice when they are performing professional activities for clients.
Compliance with such relevant ethical requirements by individuals may need to be addressed by the firm’s system of quality management.
Example of relevant ethical requirements that are applicable only to individuals and not the firm, and which relate to the performance of engagements
Part 2 of the APESB Code addresses pressure to breach the fundamental principles, and includes requirements that an individual shall not:
· Allow pressure from others to result in a breach of compliance with the fundamental principles; or
· Place pressure on others that the accountant knows, or has reason to believe, would result in the other individuals breaching the fundamental principles.
For example, circumstances may arise when, in performing an engagement, an individual considers that the engagement partner or another senior member of the engagement team has pressured them to breach the fundamental principles.
Response (Ref: Para. 16(u))
A25.Policies are implemented through the actions of personnel and other individuals whose actions are subject to the policies (including engagement teams), or through their restraint from taking actions that would conflict with the firm’s policies.
A26.Procedures may be mandated, through formal documentation or other communications, or may result from behaviours that are not mandated but are rather conditioned by the firm’s culture. Procedures may be enforced through the actions permitted by IT applications, or other aspects of the firm’s IT environment.
A27.If the firm uses individuals external to the firm in the system of quality management or in the performance of engagements, different policies or procedures may need to be designed by the firm to address the actions of the individuals. ASA 220[9] provides guidance when different policies or procedures may need to be designed by the firm to address the actions of individuals external to the firm in the context of an audit of a financial report.
[9] See ASA 220, paragraphs A23–A25.
Service Provider (Ref: Para. 16(v))
A28.Service providers include component auditors from other firms not within the firm’s network.
Applying, and Complying with, Relevant Requirements (Ref: Para. 17)
| A29. Examples of when a requirement of this ASQM may not be relevant to the firm · The firm is a sole practitioner. For example, the requirements addressing the organisational structure and assigning roles, responsibilities and authority within the firm, direction, supervision and review and addressing differences of opinion may not be relevant. · The firm only performs engagements that are related services engagements. For example, if the firm is not required to maintain independence for related services engagements, the requirement to obtain a documented confirmation of compliance with independence requirements from all personnel would not be relevant. |
A162.The results of monitoring activities, results of external inspections and other relevant information (e.g., network monitoring activities or complaints and allegations) may reveal information about the effectiveness of the monitoring and remediation process. For example, the results of external inspections may provide information about the system of quality management that has not been identified by the firm’s monitoring and remediation process, which may highlight a deficiency in that process.
Evaluating Identified Deficiencies (Ref: Para. 41)
A163.Factors the firm may consider in evaluating the severity and pervasiveness of an identified deficiency include:
·The nature of the identified deficiency, including the aspect of the firm’s system of quality management to which the deficiency relates, and whether the deficiency is in the design, implementation or operation of the system of quality management;
·In the case of identified deficiencies related to responses, whether there are compensating responses to address the quality risk to which the response relates;
·The root cause(s) of the identified deficiency;
·The frequency with which the matter giving rise to the identified deficiency occurred; and
·The magnitude of the identified deficiency, how quickly it occurred and the duration of time that it existed and had an effect on the system of quality management.
A164.The severity and pervasiveness of identified deficiencies affects the evaluation of the system of quality management that is undertaken by the individual(s) assigned ultimate responsibility and accountability for the system of quality management.
Root Cause of the Identified Deficiencies (Ref: Para. 41(a))
A165.The objective of investigating the root cause(s) of identified deficiencies is to understand the underlying circumstances that caused the deficiencies to enable the firm to:
·Evaluate the severity and pervasiveness of the identified deficiency; and
·Appropriately remediate the identified deficiency.
Performing a root cause analysis involves those performing the assessment exercising professional judgement based on the evidence available.
A166.The nature, timing and extent of the procedures undertaken to understand the root cause(s) of an identified deficiency may also be affected by the nature and circumstances of the firm, such as:
·The complexity and operating characteristics of the firm.
·The size of the firm.
·The geographical dispersion of the firm.
·How the firm is structured or the extent to which the firm concentrates or centralizes its processes or activities.
Examples of how the nature of identified deficiencies and their possible severity and the nature and circumstances of the firm may affect the nature, timing and extent of the procedures to understand the root cause(s) of the identified deficiencies
· The nature of the identified deficiency: The firm’s procedures to understand the root cause(s) of an identified deficiency may be more rigorous in circumstances when an engagement report related to an audit of a financial report of a listed entity was issued that was inappropriate or the identified deficiency relates to leadership’s actions and behaviours regarding quality.
· The possible severity of the identified deficiency: The firm’s procedures to understand the root cause(s) of an identified deficiency may be more rigorous in circumstances when the deficiency has been identified across multiple engagements or there is an indication that policies or procedures have high rates of non-compliance.
· Nature and circumstances of the firm:
o In the case of a less complex firm with a single location, the firm’s procedures to understand the root cause(s) of an identified deficiency may be simple, since the information to inform the understanding may be readily available and concentrated, and the root cause(s) may be more apparent.
o In the case of a more complex firm with multiple locations, the procedures to understand the root cause(s) of an identified deficiency may include using individuals specifically trained on investigating the root cause(s) of identified deficiencies, and developing a methodology with more formalised procedures for identifying root cause(s).
A167.In investigating the root cause(s) of identified deficiencies, the firm may consider why deficiencies did not arise in other circumstances that are of a similar nature to the matter to which the identified deficiency relates. Such information may also be useful in determining how to remediate an identified deficiency.
Example of when a deficiency did not arise in other circumstances of a similar nature, and how this information assists the firm in investigating the root cause(s) of identified deficiencies
The firm may determine that a deficiency exists because similar findings have occurred across multiple engagements. However, the findings have not occurred in several other engagements within the same population being tested. By contrasting the engagements, the firm concludes that the root cause of the identified deficiency is a lack of appropriate involvement by the engagement partners at key stages of the engagements.
A168.Identifying a root cause(s) that is appropriately specific may support the firm’s process for remediating identified deficiencies.
Example of identifying a root cause(s) that is appropriately specific
The firm may identify that engagement teams performing audits of financial reports are failing to obtain sufficient appropriate audit evidence on accounting estimates where management’s assumptions have a high degree of subjectivity. While the firm notes that these engagement teams are not exercising appropriate professional scepticism, the underlying root cause of this issue may relate to another matter, such as a cultural environment that does not encourage engagement team members to question individuals with greater authority or insufficient direction, supervision and review of the work performed on the engagements.
A169.In addition to investigating the root cause(s) of identified deficiencies, the firm may also investigate the root cause(s) of positive outcomes as doing so may reveal opportunities for the firm to improve, or further enhance, the system of quality management.
Responding to Identified Deficiencies (Ref: Para. 42)
A170.The nature, timing and extent of remedial actions may depend on a variety of other factors, including:
·The root cause(s).
·The severity and pervasiveness of the identified deficiency and therefore the urgency with which it needs to be addressed.
·The effectiveness of the remedial actions in addressing the root cause(s), such as whether the firm needs to implement more than one remedial action in order to effectively address the root cause(s), or needs to implement remedial actions as interim measures until the firm is able to implement more effective remedial actions.
A171.In some circumstances, the remedial action may include establishing additional quality objectives, or quality risks or responses may be added or modified, because it is determined that they are not appropriate.
A172.In circumstances when the firm determines that the root cause of an identified deficiency relates to a resource provided by a service provider, the firm may also:
·Consider whether to continue using the resource provided by the service provider.
·Communicate the matter to the service provider.
The firm is responsible for addressing the effect of the identified deficiency related to a resource provided by a service provider on the system of quality management and taking action to prevent the deficiency from recurring with respect to the firm’s system of quality management. However, the firm is not ordinarily responsible for remediating the identified deficiency on behalf of the service provider or further investigating the root cause of the identified deficiency at the service provider.
Findings About a Particular Engagement (Ref: Para. 45)
A173.In circumstances when procedures were omitted or the report issued is inappropriate, the action taken by the firm may include:
·Consulting with appropriate individuals regarding the appropriate action.
·Discussing the matter with management of the entity or those charged with governance.
·Performing the omitted procedures.
The actions taken by the firm do not relieve the firm of the responsibility to take further actions relating to the finding in the context of the system of quality management, including evaluating the findings to identify deficiencies and when a deficiency exists, investigating the root cause(s) of the identified deficiency.
Ongoing Communication Related to the Monitoring and Remediation (Ref: Para. 46)
A174.The information communicated about the monitoring and remediation to the individual(s) assigned ultimate responsibility and accountability for the system of quality management may be communicated on an ongoing basis or periodically. The individual(s) may use the information in multiple ways, for example:
·As a basis for further communications to personnel about the importance of quality.
·To hold individuals accountable for their roles assigned to them.
·To identify key concerns about the system of quality management in a timely manner.
The information also provides a basis for the evaluation of the system of quality management, and conclusion thereon, as required by paragraphs 53–54.
Network Requirements or Network Services (Ref: Para. 48)
A175.In some circumstances, the firm may belong to a network. Networks may establish requirements regarding the firm’s system of quality management or may make services or resources available that the firm may choose to implement or use in the design, implementation and operation of its system of quality management. Such requirements or services may be intended to promote the consistent performance of quality engagements across the firms that belong to the network. The extent to which the network will provide the firm with quality objectives, quality risks and responses that are common across the network will depend on the firm’s arrangements with the network.
Examples of network requirements
· Requirements for the firm to include additional quality objectives or quality risks in the firm’s system of quality management that are common across the network firms.
· Requirements for the firm to include responses in the firm’s system of quality management that are common across the network firms. Such responses designed by the network may include network policies or procedures that specify the leadership roles and responsibilities, including how the firm is expected to assign authority and responsibility within the firm, or resources, such as network developed methodologies for the performance of engagements or IT applications.
· Requirements that the firm be subject to the network’s monitoring activities. These monitoring activities may relate to network requirements (e.g., monitoring that the firm has implemented the network’s methodology appropriately), or to the firm’s system of quality management in general.
Examples of network services
· Services or resources that are optional for the firm to use in its system of quality management or in the performance of engagements, such as voluntary training programs, use of component auditors or experts from within the network, or use of a service delivery centre established at the network level, or by another network firm or group of network firms.
A176.The network may establish responsibilities for the firm in implementing the network requirements or network services.
Examples of responsibilities for the firm in implementing network requirements or network services
· The firm is required to have certain IT infrastructure and IT processes in place to support an IT application provided by the network that the firm uses in the system of quality management.
· The firm is required to provide firm-wide training on the methodology provided by the network, including when updates are made to the methodology.
A177.The firm’s understanding of the network requirements or network services and the firm’s responsibilities relating to the implementation thereof may be obtained through enquiries of, or documentation provided by, the network about matters such as:
·The network’s governance and leadership.
·The procedures undertaken by the network in designing, implementing and, if applicable, operating, the network requirements or network services.
·How the network identifies and responds to changes that affect the network requirements or network services or other information, such as changes in the AUASB standards or information that indicates a deficiency in the network requirements or network services.
How the network monitors the appropriateness of the network requirements or network services, which may include through the network firms’ monitoring activities, and the network’s processes for remediating identified deficiencies.
Network Requirements or Network Services in the Firm’s System of Quality Management (Ref: Para. 49)
A178.The characteristics of the network requirements or network services are a condition, event, circumstance, action or inaction in identifying and assessing quality risks.
Example of a network requirement or network service that gives rise to a quality risk
The network may require the firm to use an IT application for the acceptance and continuance of client relationships and specific engagements that is standardized across the network. This may give rise to a quality risk that the IT application does not address matters in law or regulation that need to be considered by the firm in accepting and continuing client relationships and specific engagements.
A179.The purpose of the network requirements may include the promotion of consistent performance of quality engagements across the network firms. The firm may be expected by the network to implement the network requirements, however, the firm may need to adapt or supplement the network requirements such that they are appropriate for the nature and circumstances of the firm and its engagements.
Examples of how the network requirements or networks services may need to be adapted or supplemented
Network Requirement or Network Service
How the Firm Adapts or Supplements the Network Requirement or Network Service
The network requires the firm to include certain quality risks in the system of quality management, so that all firms in the network address the quality risks.
As part of identifying and assessing quality risks, the firm includes the quality risks that are required by the network.
The firm also designs and implements responses to address the quality risks that are required by the network.
The network requires that the firm design and implement certain responses.
As part of designing and implementing responses, the firm determines:
· Which quality risks the responses address.
· How the responses required by the network will be incorporated into the firm’s system of quality management, given the nature and circumstances of the firm. This may include tailoring the response to reflect the nature and circumstances of the firm and its engagements (e.g., tailoring a methodology to include matters related to law or regulation).
The firm uses individuals from other network firms as component auditors. Network requirements are in place that drive a high degree of commonality across the network firms’ systems of quality management. The network requirements include specific criteria that apply to individuals assigned to work on a component for a group audit.
The firm establishes policies or procedures that require the engagement team to confirm with the component auditor (i.e., the other network firm) that the individuals assigned to the component meet the specific criteria set out in the network requirements.
A180.In some circumstances, in adapting or supplementing the network requirements or network services, the firm may identify possible improvements to the network requirements or network services and may communicate these improvements to the network.
Monitoring Activities Undertaken by the Network on the Firm’s System of Quality Management (Ref: Para. 50(c))
A181.The results of the network’s monitoring activities of the firm’s system of quality management may include information such as:
·A description of the monitoring activities, including their nature, timing and extent;
·Findings, identified deficiencies, and other observations about the firm’s system of quality management (e.g., positive outcomes or opportunities for the firm to improve, or further enhance, the system of quality management); and
·The network’s evaluation of the root cause(s) of the identified deficiencies, the assessed effect of the identified deficiencies and recommended remedial actions.
Monitoring Activities Undertaken by the Network Across the Network Firms (Ref: Para. 51(b))
A182.The information from the network about the overall results of the network’s monitoring activities undertaken across the network firms’ systems of quality management may be an aggregation or summary of the information described in paragraph A181, including trends and common areas of identified deficiencies across the network, or positive outcomes that may be replicated across the network. Such information may:
·Be used by the firm:
oIn identifying and assessing quality risks.
oAs part of other relevant information considered by the firm in determining whether deficiencies exist in the network requirements or network services used by the firm in its system of quality management.
·Be communicated to group engagement partners, in the context of considering the competence and capabilities of component auditors from a network firm who are subject to common network requirements (e.g., common quality objectives, quality risks and responses).
A183.In some circumstances, the firm may obtain information from the network about deficiencies identified in a network firm’s system of quality management that affects the firm. The network may also gather information from network firms regarding the results of external inspections over network firms’ systems of quality management. In some instances, law or regulation in a particular jurisdiction may prevent the network from sharing information with other network firms or may restrict the specificity of such information.
A184.In circumstances when the network does not provide the information about the overall results of the network’s monitoring activities across the network firms, the firm may take further actions, such as:
·Discussing the matter with the network; and
·Determining the effect on the firm’s engagements, and communicating the effect to engagement teams.
Deficiencies in Network Requirements or Network Services Identified by the Firm (Ref: Para. 52)
A185.As network requirements or network services used by the firm form part of the firm’s system of quality management, they are also subject to the requirements of this ASQM regarding monitoring and remediation. The network requirements or network services may be monitored by the network, the firm, or a combination of both.
Example of when a network requirement or network service is monitored by both the network and the firm
A network may undertake monitoring activities at a network level for a common methodology. The firm also monitors the application of the methodology by engagement team members through performing engagement inspections.
A186.In designing and implementing the remedial actions to address the effect of the identified deficiency in the network requirements or network services, the firm may:
·Understand the planned remedial actions by the network, including whether the firm has any responsibilities for implementing the remedial actions; and
·Consider whether supplementary remedial actions need to be taken by the firm to address the identified deficiency and the related root cause(s), such as when:
oThe network has not taken appropriate remedial actions; or
oThe network’s remedial actions will take time to effectively address the identified deficiency.
Evaluating the System of Quality Management (Ref: Para. 53)
A187.The individual(s) assigned ultimate responsibility and accountability for the system of quality management may be assisted by other individuals in performing the evaluation. Nevertheless, the individual(s) assigned ultimate responsibility and accountability for the system of quality management remains responsible and accountable for the evaluation.
A188.The point in time at which the evaluation is undertaken may depend on the circumstances of the firm, and may coincide with the fiscal year end of the firm or the completion of an annual monitoring cycle.
A189.The information that provides the basis for the evaluation of the system of quality management includes the information communicated to the individual(s) assigned ultimate responsibility and accountability for the system of quality management in accordance with paragraph 46.
Scalability examples to demonstrate how the information that provides the basis for the evaluation of the system of quality management may be obtained
· In a less complex firm, the individual(s) assigned ultimate responsibility and accountability for the system of quality management may be directly involved in the monitoring and remediation and will therefore be aware of the information that supports the evaluation of the system of quality management.
· In a more complex firm, the individual(s) assigned ultimate responsibility and accountability for the system of quality management may need to establish processes to collate, summarise and communicate the information needed to evaluate the system of quality management.
Concluding on the System of Quality Management (Ref: Para. 54)
A190.In the context of this ASQM, it is intended that the operation of the system as a whole provides the firm with reasonable assurance that the objectives of the system of quality management are being achieved. In concluding on the system of quality management, the individual(s) assigned ultimate responsibility and accountability for the system of quality management may, in using the results of the monitoring and remediation process, consider the following:
·The severity and pervasiveness of identified deficiencies, and the effect on the achievement of the objectives of the system of quality management;
·Whether remedial actions have been designed and implemented by the firm, and whether the remedial actions taken up to the time of the evaluation are effective; and
·Whether the effect of identified deficiencies on the system of quality management have been appropriately corrected, such as whether further actions have been taken in accordance with paragraph 45.
A191.There may be circumstances when identified deficiencies that are severe (including identified deficiencies that are severe and pervasive) have been appropriately remediated and the effect of them corrected at the point in time of the evaluation. In such cases, the individual(s) assigned ultimate responsibility and accountability for the system of quality management may conclude that the system of quality management provides the firm with reasonable assurance that the objectives of the system of quality management are being achieved.
A192.An identified deficiency may have a pervasive effect on the design, implementation and operation of the system of quality management when, for example:
·The deficiency affects several components or aspects of the system of quality management.
·The deficiency is confined to a specific component or aspect of the system of quality management, but is fundamental to the system of quality management.
·The deficiency affects several business units or geographical locations of the firm.
·The deficiency is confined to a business unit or geographical location, but the business unit or location affected is fundamental to the firm overall.
·The deficiency affects a substantial portion of engagements that are of a certain type or nature.
Example of an identified deficiency that may be considered severe but not pervasive
The firm identifies a deficiency in a smaller regional office of the firm. The identified deficiency relates to non-compliance with many firm policies or procedures. The firm determines that the culture in the regional office, particularly the actions and behaviour of leadership in the regional office which were overly focused on financial priorities, has contributed to the root cause of the identified deficiency. The firm determines that the effect of the identified deficiency is:
· Severe, because it relates to the culture of the regional office and overall compliance with firm policies or procedures; and
· Not pervasive, because it is limited to the smaller regional office.
A193.The individual(s) assigned ultimate responsibility and accountability for the system of quality management may conclude that the system of quality management does not provide the firm with reasonable assurance that the objectives of the system of quality management are being achieved in circumstances when identified deficiencies are severe and pervasive, actions taken to remediate the identified deficiencies are not appropriate, and the effect of the identified deficiencies have not been appropriately corrected.
Example of an identified deficiency that may be considered severe and pervasive
The firm identifies a deficiency in a regional office, which is the largest office of the firm and provides financial, operational and technical support for the entire region. The identified deficiency relates to non-compliance with many firm policies or procedures. The firm determines that the culture in the regional office, particularly the actions and behaviour of leadership in the regional office which were overly focused on financial priorities, has contributed to the root cause of the identified deficiency. The firm determines that the effect of the identified deficiency is:
· Severe, because it relates to the culture of the regional office and overall compliance with firm policies or procedures; and
· Pervasive, because the regional office is the largest office and provides support to many other offices, and the non-compliance with firm policies or procedures may have had a broader effect on the other offices.
A194.It may take time for the firm to remediate identified deficiencies that are severe and pervasive. As the firm continues to take action to remediate the identified deficiencies, the pervasiveness of the identified deficiencies may be diminished and it may be determined that the identified deficiencies are still severe, but no longer severe and pervasive. In such cases, the individual(s) assigned ultimate responsibility and accountability for the system of quality management may conclude that, except for matters related to identified deficiencies that have a severe but not pervasive effect on the design, implementation and operation of the system of quality management, the system of quality management provides the firm with reasonable assurance that the objectives of the system of quality management are being achieved.
A195.This ASQM does not require the firm to obtain an independent assurance report on its system of quality management, or preclude the firm from doing so.
Taking Prompt and Appropriate Action and Further Communication (Ref: Para. 55)
A196.In circumstances when the individual(s) assigned ultimate responsibility and accountability for the system of quality management reaches the conclusion described in paragraph 54(b) or 54(c), the prompt and appropriate action taken by the firm may include:
·Taking measures to support the performance of engagements through assigning more resources or developing more guidance and to confirm that reports issued by the firm are appropriate in the circumstances, until such time as the identified deficiencies are remediated, and communicating such measures to engagement teams.
·Obtaining legal advice.
A197.In some circumstances the firm may have an independent governing body that has non-executive oversight of the firm. In such circumstances, communications may include informing the independent governing body.
| A198. Examples of circumstances when it may be appropriate for the firm to communicate to external parties about the evaluation of the system of quality management · When the firm belongs to a network. · When other network firms use the work performed by the firm, for example, in the case of a group audit. · When a report issued by the firm is determined by the firm to be inappropriate as a result of the failure of the system of quality management, and management or those charged with governance of the entity need to be informed. · When law or regulation requires the firm to communicate to an oversight authority or a regulatory body. |
Performance Evaluations (Ref: Para. 56)
A199.Periodic performance evaluations promote accountability. In considering the performance of an individual, the firm may take into account:
·The results of the firm’s monitoring activities for aspects of the system of quality management that relate to the responsibility of the individual. In some circumstances, the firm may set targets for the individual and measure the results of the firm’s monitoring activities against those targets.
·The actions taken by the individual in response to identified deficiencies that relate to the responsibility of that individual, including the timeliness and effectiveness of such actions.
Scalability examples to demonstrate how the firm may undertake the performance evaluations
· In a less complex firm, the firm may engage a service provider to perform the evaluation, or the results of the firm’s monitoring activities may provide an indication of the performance of the individual.
· In a more complex firm, the performance evaluations may be undertaken by an independent non-executive member of the firm’s governing body, or a special committee overseen by the firm’s governing body.
A200.A positive performance evaluation may be rewarded through compensation, promotion and other incentives that focus on the individual’s commitment to quality, and reinforce accountability. On the other hand, the firm may take corrective actions to address a negative performance evaluation that may affect the firm’s achievement of its quality objectives.
Public Sector Considerations
A201.In the case of the public sector, it may not be practicable to perform a performance evaluation of the individual(s) assigned ultimate responsibility and accountability for the system of quality management, or to take actions to address the results of the performance evaluation, given the nature of the individual’s appointment. Nevertheless, performance evaluations may still be undertaken for other individuals in the firm who are assigned operational responsibility for aspects of the system of quality management.
Documentation (Ref: Para. 57–59)
A202.Documentation provides evidence that the firm complies with this ASQM, as well as law, regulation or relevant ethical requirements. It may also be useful for training personnel and engagement teams, ensuring the retention of organisational knowledge and providing a history of the basis for decisions made by the firm about its system of quality management. It is neither necessary nor practicable for the firm to document every matter considered, or judgement made, about its system of quality management. Furthermore, compliance with this ASQM may be evidenced by the firm through its information and communication component, documents or other written materials, or IT applications that are integral to the components of the system of quality management.
A203.Documentation may take the form of formal written manuals, checklists and forms, may be informally documented (e.g., e-mail communication or postings on websites), or may be held in IT applications or other digital forms (e.g., in databases). Factors that may affect the firm’s judgements about the form, content and extent of documentation, including how often documentation is updated, may include:
·The complexity of the firm and the number of offices;
·The nature and complexity of the firm’s practice and organisation;
·The nature of engagements the firm performs and the nature of the entities for whom engagements are performed;
·The nature and complexity of the matter being documented, such as whether it relates to an aspect of the system of quality management that has changed or an area of greater quality risk, and the complexity of the judgements relating to the matter; and
·The frequency and extent of changes in the system of quality management.
In a less complex firm, it may not be necessary to have documentation supporting matters communicated because informal communication methods may be effective. Nevertheless, a less complex firm may determine it appropriate to document such communications in order to provide evidence that they occurred.
A204.In some instances, an external oversight authority may establish documentation requirements, either formally or informally, for example, as a result of the outcome of external inspection findings. Relevant ethical requirements may also include specific requirements addressing documentation, for example, the APESB Code requires documentation of particular matters, including certain situations related to conflicts of interest, non-compliance with laws and regulations and independence.
A205.The firm is not required to document the consideration of every condition, event, circumstance, action or inaction for each quality objective, or each risk that may give rise to a quality risk. However, in documenting the quality risks and how the firm’s responses address the quality risks, the firm may document the reasons for the assessment given to the quality risks (i.e., the considered occurrence and effect on the achievement of one or more quality objectives), in order to support the consistent implementation and operation of the responses.
A206.The documentation may be provided by the network, other network firms, or other structures or organisations within the network.
0
0
0