Compliance with the International Standards on Quality Management (ISQMs) is a journey, not a destination, and wherever your firm is on this voyage of discovery, more work will be required during 2024 and beyond. 

The ISQMs can be a driver for positive change and ICAEW’s Audit Monitoring Report 2022/2023 explores how proactive firms are using ISQM 1 implementation and their system of quality management (SoQM) to drive continuous improvement. The report also flags areas where the Quality Assurance Department (QAD) found weaknesses, offers tips on addressing these, and shares examples of good practices.

Firms will find this a useful resource. No SoQM is ever going to be perfect, but as Nick Reynolds, Senior Manager, QAD, noted at ICAEW’s November 2023 event on ‘Maintaining momentum’, continuous evolution and development of the SoQM is vital. Like the latest audit monitoring report, the event’s expert panel session and round-table discussions among auditors, trainers and reviewers, offered insights that can assist firms as they evolve their SoQM.

Auditors reflected on their experiences implementing ISQM 1 so far, sharing learnings, challenges encountered, how they were overcome and how they can promote continuous improvement going forward. Panel guests ranged across small and mid-tier firms, larger firms and networks.

Auditor perspectives

The experiences of panellist Luke Parker, one of three partners with Gilberts Chartered Accountants, seemed to resonate with many at the event – he shared insights into his firm’s approach to implementing ISQM 1 and reaping the benefits here. Reflecting on round-table discussions at ‘Maintaining momentum’ he says: “Practices of all sizes from small to large have had issues getting full buy-in from all partners. It is hard work convincing those that see ISQM 1 as a box ticking exercise that it can actually be a driver for positive change.”

Other concerns also emerged during the round-table discussions among auditors. “On my table, some auditors felt very isolated in their role implementing ISQM 1,” says panellist Hugh Morgan, Technical Director, RSM UK. “They were either doing it on their own or had little input from others,” he says, so they were very positive about the ISQM event. “It gave them a chance to talk to others in the same position,” he says. 

This perspective is echoed by other panellists. “Isolation was a theme,” says panellist Gill Spaul, who is European Director of Audit Quality at Moore Global. People also shared concerns about the future of quality management under ISQM 1. “They are aware that the journey is forever,” she says, but don’t see an appreciation of this among others in their firm, where ISQM 1 implementation is seen as a destination. “They worry about support in the future.”

Firms worked hard to implement their SoQM ahead of the 15 December 2022 deadline and since then the focus has shifted to how to maintain this system. Monitoring and remediation is critical to this, and the event’s round-table discussions explored what monitoring activities and remedial actions firms have undertaken so far and what they plan to do in the future. 

Independent cold file reviews played a key part in firms’ 2023 monitoring activities, but with firms changing file selection criteria and more live file reviews taking place throughout the year. Shifting to a more proactive monitoring approach ensures timely and reliable information is fed back into the SoQM to enable detection of emerging issues. In light of the new CPD requirements, targeted CPD and utilising learning management systems, to ensure staff attend relevant training sessions, were also popular monitoring choices among firms. 

Root cause analysis

Root cause analysis (RCA) of identified deficiencies is a key part of monitoring and remediation, but it can seem daunting. Many auditors will be unfamiliar with RCA and will need to develop new skills. Various providers offer courses and tools to assist auditors with RCA and help them to understand how it can be applied in their practice. 

Parker, who is responsible for RCA among his three-partner group at Gilberts, says that RCA training and RCA processes are not difficult, but like others at the event, he found that they do take time. Back in 2022, Parker spent a couple of days on RCA training and considers this a worthwhile investment. “It adds another string to your bow and it’s useful to think of things in a different way,” says the auditor, who has found his foray into RCA both interesting and rewarding.

At ICAEW’s ‘Maintaining momentum’ event, Jonathan Batchelor, Managing Director, EMEA, at RCA specialist SoLogic, delivered a training session that highlighted the practical benefits of implementing RCA principles. Using thought-provoking anecdotes and case studies, he explored how to introduce and embed an RCA mindset. He also shone a light on the fact that it’s important not just to ask “why?”, but to ask the right questions and understand that often, there isn’t just one causal factor. 

Batchelor also emphasised the benefits of asking these questions, not just when things go wrong but, crucially, when things go right too. A view that was echoed during the event’s round-table discussions, where some auditors shared their experiences of embracing ‘positive’ root cause analysis.

Round-table discussions at the November 2023 event found firms at a wide range of stages in implementing RCA. Some had not yet started; some already had established internal and external teams from wider networks and service providers in place. 

At Gilberts, Parker began the firm’s preparations for RCA in 2022, and outlines the firm’s approach here. He’s seen the benefits and urges other smaller firms that may not yet be familiar with RCA to take a proportionate approach. “This is likely to be much more simplistic than the larger firm approach, but that does not mean it won’t be effective,” he says, adding: “For smaller firms, try to take a pragmatic approach and define RCA and wider procedures that fit your organisation.”

Many firms acknowledged the need to develop a more rounded view by bringing more people into the RCA process, including auditors and non-auditors with differing skills and seniority. While some firms advocated independence as an important selection criterion to aid difficult discussions, others championed the use of internal teams, with the ability to be able to constructively challenge senior partners indicative of a healthy culture that can only benefit audit quality. 

Engagement quality reviews (EQR) form part of the new quality management regime introduced by ISQM 1 and ISQM 2. Firms are required to conduct an EQR on audits of listed companies, on audits and other engagements where an EQR is required by law or regulations, and on audits or other engagements for which the firm determines that an EQR is an appropriate response to address one or more quality risks. For some firms at the event, these EQRs are proving invaluable in RCA. 

Understanding whether an identified deficiency is an isolated issue or indicative of a systemic problem is providing interesting insights, with some firms routinely preparing thematic reports pulled from individual EQR findings to identify deficiencies. These firms are building up banks of information from RCA findings, with the consensus being that the more RCA you can do, the better. For some firms, behavioural training has emerged as essential in identifying the ‘why?’. 

Take the time

The initial ‘first-time’ implementation of the new quality management standards ISQM 1 and ISQM 2 and the revised auditing standard for quality management (ISA 220) was a big undertaking for many firms, with lack of time and resources a key barrier. But as the standard provides a framework to help evolve and improve an SoQM over time, firms should take comfort in knowing that it’s the small steps towards building a strong and resilient SoQM that matter.