When Luke Parker, a partner at Gilberts, first started looking into ISQM 1 in earnest a few months ago, he admits his initial perception was that it constituted “just more compliance”. But already the firm is reaping the benefits of a new approach to quality management.
St Albans-based Gilberts is a three-partner practice with 28 staff in total, undertaking around 30 audits a year across a range of sectors and company sizes from SMEs to larger entities. Its starting point for ISQM 1 was some background reading on the new standard – Parker says ICAEW’s resources were a very useful starting point. He also participated in some webinars and undertook dedicated training on root cause analysis.
Rather than forcing firms to go back to the drawing board on quality management, the foundations provided by ISQC are helpful. “We believe we have robust systems and controls in place, but they just weren't documented and defined. So, for us, it's been about putting it on paper, which then helped us to consider whether there are improvements to be made. But we’re happy with most of the responses that were already there.”
Parker adapted a template policy document from service provider Mercia so it applied to Gilberts’ specific circumstances. He says he spent some time figuring out how to do this – the Mercia policy document is around 20 pages long while Gilberts’ existing documentation ran to three or four pages. “Using an external provider gives you a starting point, then you can figure out what is and isn’t applicable to you, rather than trying to build it from scratch. That's been really helpful for us.”
How can businesses benefit from root cause analysis
One of the biggest differences between ISQC 1 and ISQM 1 is the introduction of root cause analysis. Gilberts turned to Sologic for root cause analysis training. “We did an exercise to identify the different levels of root cause analysis that you can undertake and what they would mean for us. The level of root cause analysis that you can go into is very detailed. You can have whole teams that are running separate interviews across multiple departments for a week. It’s something that doesn't really apply to a firm of our size.”
In the end, the firm identified specific trigger points that would prompt a root cause analysis session – perhaps an hour or two with the engagement team – to figure out what went wrong. “For more serious cases, if those trigger points occur then we probably undertake independent reviews of the interviews of the engagement team and do further fact-finding exercises if necessary,” Parker says.
The iterative nature of ISQM 1 means that any future issues identified by root cause analysis should result in further fine tuning of the process. “The trigger points as to what we think requires a root cause analysis, how we do the root cause analysis and how we then monitor things – I can see all of that evolving because if we flag something and it recurs the following year, you realise that what you've implemented hasn't worked. It's going to be an evolving process as we get more used to it.”
Nonetheless, use of root cause analysis has already been beneficial, Parker says. “We did an exercise of identifying the causal pairs for each and there were certainly some avenues of thought that you might not have gone down otherwise.” Personally, Parker has found the foray into RCA both interesting and useful.
“It was a new skill to learn. The courses out there are good and help you figure out how it's going to apply to the practice. There's nothing difficult. It just takes time. It's another string to your bow, and it’s useful to think of things in a different way.”
So far, Parker estimates that he has spent around three days developing the firm’s quality management systems under ISQM 1, including a couple of days specifically on root cause analysis. Investing in training is money well spent, he believes.
Parker is confident that a solid system of quality management will be in place by the 15 December deadline. Nonetheless, firms shouldn’t panic if they haven’t yet started on their ISQM 1 journey. “It's about committing to a block of time. And it's not quite as scary as it first looks. You’re probably already doing a lot of it without realising.”
Quality management in audit firms
Resources to help audit firms prepare for new quality management standards ISQM 1, ISQM 2 and ISA 220 (Revised).