As a member of ICAEW’s ISQM working group, Rachel Davis is more than aware of the impending arrival of the new quality management standard for audit firms. Having bitten the bullet and started down the ISQM 1 route, Davis is already reaping the benefit, she says, although the process of moving from ‘quality control’ to ‘quality management’ requires a significant and regular time commitment, she warns.

Davis is the owner of Just Audit, a 14-person firm that has been providing pure audit services to a host of clients since 2006. “We work alongside general practitioners who can’t do audit, don’t do audit or are conflicted,” Davis explains. In addition to the statutory audit of limited companies, the firm also carries out Solicitors’ Accounts Rules, CASS 5 Audits and ATOL accountants’ reports.

When it comes to adding value to your firm, ISQM marks a distinct step up from the previous ‘off-the-shelf’ quality control approach, Davis believes. “The new quality management standard is far better and makes you put procedures in place that you probably ought to have had in any case. It makes you think harder about all sorts of different things. Before we even got into ISQM, the senior management team said, ‘we ask our clients what are their risks, why the heck haven’t we done it ourselves?’”

Davis, who has been on the ICAEW Practice Committee since 2011, admits that reading the 73-page standard left her cold. Instead, her approach has been to immerse herself in training and education materials to help bring the standard to life. She highlights webinars from the Financial Reporting Council, the International Auditing and Assurance Standards Board, and an ICAEW series hosted by John Selwood and Peter Herbert as being particularly useful. “Then I read the standard and the application notes and felt like I understood where they were coming from.” 

ISQM 1 comprises eight interrelated components that deal with the key aspects of the system of quality management. Embarking upon the process of understanding your firm’s specific quality risks across those components by starting with a blank sheet of paper is a great idea in theory, “if you’re a technical expert who could interpret the standard, unpick the requirements, and then perfectly document and execute it. I doubt that’s many people,” says Davis. 

In addition, she admits the ‘one-to-many’ and ‘many-to-one’ concept was daunting. “My spreadsheets are the messiest in the firm,” Davis jokes. “The idea of a spreadsheet, without version control, linking the one-to-many and many-to-one responses could be a nightmare just waiting to happen!”

Instead, Davis turned to technology – and specifically to Inflo’s QMS software to guide her through the process. The software unpicks the requirements of the ISQM standard and prompts you to think about the risks you face that fall under that specific banner. 

So far, the firm has worked through three of the ISQM components, including Engagement Performance, Acceptance and Continuance, and Governance and Leadership. “For each quality objective within that section we considered and documented the risks our firm specifically faces before going on to document the response to that risk. The response was sometimes a procedure we already had in place – or in some instances it got us to think harder and realised the need to design an appropriate response.

“I did the first two sections on my own, just to crack through some of this as I just wanted to have a tactic. But we tackled the third section – Governance and Leadership – together as a senior leadership team, which was really productive and preferable as far as time will allow.” 

The Inflo QMS software serves very much as a starting point and helps to structure and stimulate conversations about potential areas of risk, but what it doesn’t do is tell you what your risks are. “There are so many variables,” Davis says. “The size of your team, the nature of your team, the geographical spread of your team, the qualifications of your team, your clients, the software that you use, the procedures you’ve put in place and perhaps the sticking plasters you’ve put in place over the years”. 

The firm used responses from inflo QMS to ensure that policies and procedures were appropriately updated. “By working through the QMS we realised there were other questions or considerations that would be useful to include in the existing checklist when we are considering taking on new clients. Current documentation is being improved not only to ensure compliance with the new requirements but for the long-term benefit of the firm.” 

Davis’s advice to others yet to embark upon the ISQM process is clear: “Make sure you immerse yourself in just the understanding of it before you get started. There are plenty of good webinars to get a feel for it before diving in.”

At the same time, prepare yourself for the fact that it will be an iterative process, she adds. “You’re never going to get it perfect from the word go. Pick up your pen and do something. Engagement Performance was a huge area to start with but at the same time, it is central to your business, which is why I started on it. I think it was useful because it’s your bread and butter.”

Dedicating regular time to ISQM will pay off, Davis adds, ideally with other members of your senior management team, if appropriate. “I have put aside some time every Friday to look at it. You need to dedicate a certain amount of time on a regular basis. Treat it like a client meeting to make sure it doesn’t get bumped. If you wait to do it all at once you may feel a little bit shell-shocked.” 

Davis already feels as if her firm has benefited significantly from the process to date. In particular, the new standard is helpful in encouraging firms to consider perspectives that may not have been on their radar. “It goes well beyond simply how you do an audit – it covers structure, HR policies and much more.” Longer term, Davis is confident that better documentation of processes along all stages of the client journey thanks to ISQM will make it easier for new starters to bed in. 

Similarly, use of root-cause analysis is anticipated to spawn lots of ideas and quality improvements. For root-cause analysis (RCA), Davis says the five-step Sologic methodology has been incredibly useful. “We’ve got so much out of it, and it’s just the beginning. Several team members attended Sologic RCA facilitation training and we have followed that up with regular sub team meetings to carry out root cause analysis on a recurring issue.” 

The technique of identifying, understanding and solving the deeper ‘root causes’ of problems has unearthed causes that we wouldn’t have imagined and prompted some interesting suggestions – from updating standard documents and procedures to more radical suggestions such as changing audit software and ripping up timesheets. “Every little change culminates in making a huge difference. It forces you to think outside the box and that’s very powerful.”

Even though implementation of the new quality standards and root cause analysis comes at a time when team members are more pressed for time than usual, Davis says she can already see small positive changes across everything they do as a practice. “I urge firms to approach it with a positive mindset and make those hours of extra work create positive benefits for the practice, beyond simply compliance.” 

Further reading

• ISQM 1: the benefits for smaller firms
• Why quality management is more than just compliance
• Quality management standards: a tailored approach