For those firms merely going through the motions on audit quality and perceiving the new quality management standards due to come into effect in December as little more than a necessary evil, Julia Penny’s message is clear. Audit quality must be on their agenda, she says, “because if we don’t have a quality audit we don’t have a product that works at all. The whole point of audit is that it gives people reassurance that what’s in the financial statements is true and fair.”

Penny – ICAEW’s Deputy President, who will step up to the role of President in June this year – is well placed to pass judgement on the standards, having specialised in audit alongside financial reporting and anti-money laundering, and forged a successful career in accountancy training and technical roles.

She says the new suite of quality management standards signals a real shift in focus. “People might think that it’s just a change of words from quality control to quality management, but it is about managing your risks to quality. With the quality control approach, it was a case of saying: ‘Here’s a list of things that we think you should do because we think it will help to ensure quality.’”

With perceived audit failures dominating the headlines in recent years, it became clear that a shift away from a one-size-fits-all approach to audit quality was needed. “The reality is that auditing a huge, listed company or a small local business presents different sorts of risks, and even though some may be standard there will be nuances. It’s in those nuances that the quality control approach hasn’t worked,” says Penny.

However, she doesn’t believe that the introduction of the new standards signals an admission that ISQM’s quality control predecessors weren’t fit for purpose. “Not at all. We weren’t doing it wrong before, it was just a narrower approach. We’re always in a continual learning mode. I think if we feel that we can’t improve the way we do things, that would be the real failure.”

Now, despite a general ramping up of audit quality over the past few decades, expectations have also increased and the bar has moved, Penny says. The new quality management standard sets out quality objectives with the onus on firms to demonstrate that they understand their quality risks and have mitigated against them.

Rather than comply with the mandatory control procedures laid out in an off-the-shelf audit procedures manual, the process of firms understanding their own specific risks is a far more involved and complicated process. However, they should not feel too daunted by the task ahead, she reassures: “Quite a lot of the risks and mitigating steps will be fairly common – whether you’re auditing public interest entities or high street retailers, for example. That’s where I think we’ll see service providers such as software companies and training providers supply frameworks with likely risks and responses to those risks; then the firm will have to think about whether they have any additional risks relevant to them that will require tweaking.” 

The International Auditing and Assurance Standards Board responsible for ISQM has also produced comprehensive advice for firms, including first-time implementation guides for ISQM 1, ISQM 2 and ISA 220. At the same time, ICAEW’s Audit Faculty is providing a wealth of guidance to members on both the technicalities and the practicalities of ISQM. 

While historically the quality focus on technical aspects of audit quality has meant that cultural risks may have been glossed over, the new standards have governance and leadership and the public interest role of audit firmly in their sights. 

“You’re not just auditing because it’s a job,” Penny says. “You’re auditing because it really helps markets work effectively. Not just the capital markets. Most of the world’s businesses are small businesses and audit helps to ensure that they’re ticking over properly and being properly run.”

What might be challenging for firms is for those in leadership positions to reinforce that public interest role – “not just talk the talk but also walk the walk,” she says. “For example, if the senior people in the firm say they are too busy to attend training courses, it sends out a message to the rest of the firm that training doesn’t matter. There’s a lot of emphasis on creating the right culture. You also need an environment where everyone can question everyone else, regardless of seniority. The recent case of the Carillion audit junior being fined by the Financial Reporting Council is a stark reminder of the need for staff at all levels to speak up. 

“In some firms there’s a feeling that you can jeopardise your promotion opportunities and employment chances by speaking up, but if this is really going to work you need to allow everyone to have a voice. That can be a real culture change. If we have 10, 20 eyes on the problem we’re much more likely to pick up on something that’s going off on the wrong track.” 

Another potential sticking point with the new quality management standards is the need for firms to conduct root cause analysis (RCA) on any quality issues flagged up. “The end result might be a technical issue but often the problem stems from underlying issues such as culture or resources. I think mandatory RCA from a monitoring point of view will be a big shock to smaller and medium-sized firms who aren’t used to doing it.”

Despite the potential for teething problems, Penny urges firms to embrace the new standards as a positive with the potential to offer a host of broader benefits. “A system that ensures you have a quality audit is a vital part of your business management. And you could apply those same quality management principles to tax, to insolvency, to all areas of your practice, to create a shift in your quality management process that focuses on risks.” 

It will take some time for the benefits of the new quality management standards to have a discernible impact, Penny thinks, but the longer-term benefits are a given, she believes: “I am very hopeful that it will lead to improvements because I think there’s a growing recognition of the importance of psychology in audit. Auditors are human beings and we have to take account of the human element because it gets us to recognise the risks we are really facing.”