International Standard on Quality Management (UK) 1 (ISQM1), replaced ISQC1 on 15 December 2022. The new standard represents an important shift in expectations of audit procedures within firms, with arguably a more proactive, iterative approach to maintaining audit quality as opposed to ISQC1.

The new standard is scalable, as was its predecessor. An important development is the need for firms to conduct their own risk assessment, tailored to consider factors such as their structure, clients, staff and other resources to inform their responses to quality objectives and develop procedures suitable for each firm’s own circumstances.

Early indications from the Quality Assurance Department (QAD) survey of 150 firms in January 2023 were positive and this has been reinforced by the results of monitoring visits over the course of 2023.

At firms with small numbers of audits and few audit staff, ISQM1 has not required substantial changes so far. If nothing else, this was a good opportunity to revisit established procedures and in some cased improve the formality of policies and documentation to support processes in some areas.

If there is one area where there is likely to be more change for these firms, it is the requirements for root cause analysis and remediation. Previously, where firms have identified audits that need improvement, the response to this may have been fairly generic, reflecting an intention to address matters or document work better at the next audit. ISQM1 will require more structure and thought than this. Firms must consider why deficiencies happened and how they can prevent similar deficiencies in the future through improving whole-firm audit procedures, and then monitor progress.

QAD has seen a lot of development of whole-firm procedures at medium-sized and larger audit firms. Continuing professional development and independence are core areas needing robust procedures, and the process of ISQM1 implementation has highlighted the increasing need for better designed processes with databases and logs to track issues.

Unsurprisingly ‘implementing ISQM1’ was not something that simply happened at overnight on 15 December 2022. Firms may have prepared a full set of audit procedures at that point, but the operation of those procedures will have started over a period of time, and some may already have been adapted and improved with experience.

Root cause analysis for many firms is still in its infancy, and is likely to take some time to embed into a procedure suitable for each audit firm with a balance between a process that gets to a well-considered view of the root cause (or more likely root causes) of a deficiency, and one that works on a timely basis to enable the firm to implement changes that will improve audit quality within weeks rather than months and years.

QAD has seen existing monitoring processes broadly maintained over this first year of ISQM1, and monitoring and remediation is probably the most significant area that will need further work at many firms. The cycle of monitoring, evaluation, remediation, post-implementation review and further monitoring should become the driving force for the system of quality management.

Monitoring needs to be timely, so apart from the smallest audit firms it is unlikely that a single annual process will be sufficient. QAD has seen how some firms have spread their cycle of reviews of completed engagements across the year, and also adopted additional targeted reviews in areas such as client acceptance and the work done by engagement teams to address new ISAs such as ISA 315.

Firms have made good progress and it is important that all remain focused on ensuring that their system of quality management is properly maintained and effective over the long term. One year on, all firms should now be completing the evaluation and conclusions on their system of quality management, and documenting this, if they have not done it already.

Further reading

• ICAEW quality management hub
• ISQM1: implementation and expectations
• 2022/23 Audit Monitoring Report