Engagement quality review requirements changed with the new international quality management standard ISQM 2/ISQM (UK) 2. These changes may have a particular impact on small and medium-sized practices (SMPs), especially those that did not have to perform any engagement quality control reviews under the predecessor standard (ISQC 1). This article outlines how SMPs may approach the practicalities of the changed requirements.

Although ISQM 2 and ISQM (UK) 2 are effective for audits and reviews of financial statements for periods beginning on or after 15 December 2022, and for other assurance and related services engagements beginning on or after 15 December 2022, this article will focus on the requirements for audit engagements. During the article, subsequent references to ISQM 2 can be read as also referring to ISQM (UK) 2.

Terms of reference

ISQM 2 addresses the appointment and eligibility of the ‘engagement quality reviewer’ and their responsibilities relating to performance and documentation of an ‘engagement quality review’. 

Auditors may already be familiar with ‘hot reviews’, ‘second partner reviews’, ‘concurring reviews’, ‘in process reviews’, ‘pre-signing reviews’ or ‘independent partner reviews’. Although these terms are often used interchangeably, they do not necessarily mean the same thing and are subject to differing interpretations.

For the purposes of ISQM 2 an engagement quality review is defined as:

“An objective evaluation of the significant judgements made by the engagement team and the conclusions reached thereon, performed by the engagement quality reviewer and completed on or before the date of the engagement report.” 

It is crucial for firms to be clear about the type of review being performed, and whether this is a formal ISQM 2 engagement quality review with the corresponding eligibility, performance, and documentation requirements, or whether it is an internal quality risk response that does not require the rigour or scope of an ISQM 2 compliant engagement quality review. 

Identifying the need for an engagement quality review

Engagement quality reviews are required under ISQM 2 for:

• audits of financial statements of listed entities;
• audits or other engagements for which an engagement quality review is required by law or regulation; and 
• audits or other engagements for which the firm determines that an engagement quality review is an appropriate response to address one or more quality risks.

All firms, including those that do not have listed entity clients, will need to have in place policies and procedures that facilitate the identification of a need for an engagement quality review as a result of the identification of quality risks.

This may present a particular challenge for SMPs if previously established criteria for discretionary engagement quality control review were only rarely, if ever, met. 

SMPs will need to ensure that their policies and procedures:

• make clear the characteristics of quality risk which would trigger the ISQM 2 requirement for an engagement quality review;
• identify relevant quality risks; and
• trigger the ISQM 2 engagement quality review requirement when necessary.

All firms will also need to have established a plan of action should an ISQM 2 engagement quality review requirement be triggered. 

Examples of scenarios giving rise to quality risks where a firm may determine that an engagement quality review is required could include:

• audits that involve a high level of complexity or judgement due to significant accounting judgements with high degrees of uncertainty, or where specialised skills and knowledge are required to evaluate underlying subject matter;
• audits where significant issues have been encountered, such as a material restatement of comparatives;
• an audit or engagement for which unusual circumstances have been identified during acceptance and continuance procedures, such as a disagreement with the previous auditor;
• engagements which involve reporting to regulators and which may contain a high degree of judgement, such as a listing prospectus;
• audits and engagements for which the firm has no prior relevant specialist experience (for example, where the client operates in a high-risk sector which has not previously been reflected in the firm’s client base); and
• engagements where ethical threats have been identified, and it is considered that the use of an engagement quality review could mitigate these.

It is important to remember that while the engagement quality review requirement is often identified at a very early stage in the audit engagement, this may not always be the case. Engagement partners must at all times be alert to the possibility that the requirement could be triggered as a result of issues arising or circumstances being recognised during the course of the audit.

Enhanced eligibility criteria for engagement quality reviewers

One of the key new requirements of ISQM 2 is the establishment of a two-year cooling-off period before an audit engagement partner for an audited entity (or group) can act as engagement quality reviewer for that audited entity (or group). 

For firms that only have a limited number of Responsible Individuals (RIs) who can perform the role of engagement quality reviewer, this could present a problem. As it will not be possible for the same person to ‘flip’ between being the RI and engagement quality reviewer in consecutive years, a firm may run out of possible candidates. The Financial Reporting Council’s (FRC’s) Ethical Standard applying to public interest entity (PIE) and other listed entity audits is even more stringent, with a period of five years required before an RI can act as an engagement quality reviewer for the engagement.

Smaller firms should think carefully about succession planning for engagement partners and engagement quality reviewers in the future. 

The FRC’s April 2023 guidance on eligibility for appointment as a statutory auditor provides clarity for UK firms on who can undertake the role of engagement quality reviewer. It gives helpful guidance for smaller firms on how to approach the appointment of an engagement quality reviewer, including where the firm is a sole practitioner or where there are no other individuals in the firm who are eligible to perform an engagement quality review.

In such circumstances, FRC guidance confirms that the statutory auditor may appoint an engagement quality reviewer who is external to the firm. The disclosure of documents or information to the external engagement quality reviewer will not constitute a breach of the statutory auditor’s duty of confidentiality. However, the external engagement quality reviewer will be bound by the same confidentiality requirements as the statutory auditor.

Appointing an external engagement quality reviewer

There are various considerations for a firm when contemplating the appointment of an external engagement quality reviewer. Most importantly, the individual appointed to perform the review must be eligible for appointment as a statutory auditor themselves. This means they must be a member of a recognised supervisory body, such as ICAEW, and they need to hold an appropriate qualification, such as ICAEW’s Audit Qualification or equivalent. 

A further consideration for firms choosing to appoint an external engagement quality reviewer is that the firm appointing them remains responsible for all aspects of the engagement quality review under the requirements of ISQM 1 and ISQM 2. The firm therefore has a responsibility to determine that the individual is appropriate for use as an engagement quality reviewer, and that they meet the eligibility criteria set out in paragraph 18 of ISQM 2. 

In making this determination, firms may want to consider whether, for example, the individual to be appointed: 

• is familiar with professional standards, legal and regulatory requirements, and the firm’s own policies and procedures;
• has had recent involvement with and knowledge of engagements of a similar nature;
• is authorised to appropriately challenge the engagement team on significant judgements; and
• understands any additional engagement quality reviewer responsibilities in performing and documenting the engagement quality review for an audit engagement.

Other considerations include the firm’s previous experience with the individual and/or the network, with another network firm or with a service provider, as well as their reputation in the market. There may also be related quality objectives and quality risks, for example if the engagement quality reviewer does not follow the firm’s policies or procedures relevant to an audit engagement for a PIE.

More robust performance and documentation requirements

Getting the timings right for involving an engagement quality reviewer can be challenging, especially where a firm is using an external reviewer whose time will need to be scheduled in advance. 

ISQM 2 clarifies that the engagement quality reviewer should perform procedures at appropriate points in time during the engagement, so they will probably need to be involved to varying extents throughout the course of the audit, rather than just at the completion stage. 

This may create challenges for firms employing an external engagement quality reviewer, or for firms where there are specific resource constraints (eg, relating to capacity) that may make prolonged (and possibly unpredictable) involvement of the engagement quality reviewer difficult on top of the rest of their workload. Where firms identify that logistics and capacity may be a problem, timely planning and realistic time budgets may help.

The engagement quality reviewer is required to review and understand the significant judgements made by the engagement team (see ISQM 2, para 25). They will determine whether the audit engagement documentation supports those judgements and whether the conclusions reached are appropriate. In doing so, the engagement quality reviewer will specifically evaluate whether the engagement team has exercised professional scepticism in reaching those conclusions.

The engagement quality reviewer is also required to evaluate:

• the engagement partner’s determination that independence requirements have been fulfilled;
• whether appropriate consultation has taken place on difficult or contentious matters; and 
• whether the engagement partner has sufficient and appropriate involvement with the audit engagement to be able to assess the judgements and conclusions reached by the engagement team.

The engagement partner cannot sign the audit report until the engagement quality reviewer has completed a ‘stand back’ to determine whether all the requirements for the engagement quality review have been met and whether the review is complete. Again, this will need to be reflected in time budgets for engagements and individuals.

The standard also contains a specific requirement for the audit firm to establish policies or procedures for the engagement quality reviewer to be responsible for the documentation of the review, which must be included in the audit documentation. Since the requirements in the standard are principles-based rather than prescriptive, these policies and procedures may also specify which pieces of engagement documentation are to be reviewed by the engagement quality reviewer and could indicate that they should exercise professional judgement in reviewing additional engagement documentation relating to significant judgements. 

In any case, documentation must be sufficient to allow an experienced practitioner, having no previous connection to the engagement, to understand the nature, timing and extent of the engagement quality review procedures performed. 

The overall nature, timing and extent of the engagement quality review procedures will vary based on the nature and circumstances of the engagement, or the entity, so may be less extensive for engagements involving fewer significant judgements. This can be helpful for firms in terms of scalability of the standard. Although a firm may have determined that an engagement quality review is needed based on the circumstances of the engagement and, in particular, as a response to specific quality risks, the volume of work effort required for that engagement quality review may be lower than that required for a listed entity audit.