Some smaller independent audit firms face significant challenges around continuing implementation of the International Standard on Quality Management, ISQM 1, which became effective on 15 December 2022. The following tips suggest approaches that can help firms to overcome barriers to progress and tackle existing and emerging risks.

1. Think small first and be smart

All audit firms are required to have a system of quality management (SoQM), but this need not be as daunting as it may have initially appeared. A simple set of procedures (maybe three-to-four pages long) is likely to be sufficient if they deal with the steps the firm takes to mitigate quality risks and to comply with key ISQM 1 quality objectives in the following areas:

• governance and leadership;
• relevant ethical requirements;
• acceptance and continuance procedures;
• engagement performance;
• resources; and
• information and communication.

Firms should aim to be as smart as possible in respect of routine actions that support these quality management procedures. Can web forms be used for annual confirmations for example? Can appraisals be timely and focused? Also, can you work with your external reviewer and get them to assist with monitoring?

2. Involve others

In smaller practices, partners with ISQM 1 responsibilities often feel isolated and struggle to get full buy-in from others who see it as ‘a compliance thing’. Yet involving others is crucial and we would encourage those responsible for ISQM 1 to sell the commercial and operational benefits of a team approach. Benefits can include, for example, streamlined processes, reduced complaints, less time spent fixing things, sharing of good practices and fewer fee disputes.

3. Don’t be daunted by root cause analysis

Because some are daunted by root cause analysis (RCA) and don’t really understand it, they don’t embrace it; yet it is crucial to quality monitoring and remediation. Again, we would encourage firms to think small first when implementing RCA.

Although there are various RCA methodologies out there, the ‘5-Whys’ approach is perhaps the best known and it’s a good one to use if you’re unfamiliar with the concept. 

At our November 2024 virtual event ISQM 1 – maintaining momentum and feeling safe feedback from ICAEW’s Quality Assurance Department (QAD) was that many firms only perform RCA on key cold file review findings. While firms should aspire to use it more widely, this might be a good place to start.

When performing RCA on such findings, getting someone independent of the audit team involved is good practice – although this can create challenges in a very small firm. Remember to keep simple notes of what you’ve done during RCA, for the record, and keep the process simple. Stop asking ‘Why?’ when you feel that you’ve properly understood the root cause.

4. Work on creating an effective feedback culture

Even those that do understand RCA can find the prospect unappealing because of the need to have ‘difficult’ internal conversations about what’s gone wrong, which may leave the audit team feeling attacked and disengaged. Although a ‘feedback culture’ is not an easy thing to embed, we encourage firms to persevere on this, as it allows team members to be vulnerable, share their ideas and ask for help.

Feedback is often most effective when a ‘little and regular’ approach is used and where feedback is backed up with facts. Wherever possible, balance positive and negative feedback. Support rather than threaten and be willing to ask as well as tell.

Creating a good SoQM often requires cultural changes within a firm and working on a sound feedback culture might be a very good starting place for those that are struggling to make inroads.

5. Be alive to emerging risks

After ISQM 1 was initially published in 2020, the aspect that got most coverage was the need for firms to identify, assess and tackle audit quality risks. Despite the passage of time, however, some firms have made little progress beyond this.

Remember that your risk assessment and related responses should be revisited frequently, and certainly as part of the annual evaluation of your SoQM (see support resources, below). Firms need to consider whether initiatives that they’ve taken to address audit quality risks have been successful. If not, why not – and is a ‘plan b’ required?

Also does the firm’s monitoring and remediation work evidence new audit quality risks that need to be responded to? While monitoring and remediation should consist of more than just cold file reviews, such reviews (and related RCA) is likely to be central to this process.

Firms should also be alive to risks that may be created by emerging issues. Matters discussed during ICAEW’s November 2024 virtual event on ISQM 1 include: 

• issues created by the implementation of the revised group audit standard ISA 600 for accounting periods beginning on or after 15 December 2023; 
• challenges resulting from increasing automation and applications of artificial intelligence;
• audit market factors (including consolidation); and 
• changes to ICAEW’s Audit Regulations.

During breakout sessions at the recent event, when delegates had the opportunity to discuss their own experiences of implementing ISQM 1, themes that emerged for smaller independent firms to consider include:

• the value of regularly discussing audit quality issues as a team, ideally in an informal environment with the focus on ‘little and regular’; and

• among firms that had received a post-ISQM 1 implementation visit from QAD, the view that this had been a positive experience, with reviewers very keen to help, advise and provide feedback on steps firms had taken.

However, for some participants in the breakout discussions, the key to good quality audits rests with the fundamentals. Notably:

• experienced auditors helping junior colleagues to develop a good grasp of audit assertions and how to use them in planning and performing audits; and 
• the need for firms to be relentless in their pursuit of professional scepticism. 

A good SoQM is central to achieving these goals, but in an environment where remote working and staff shortages create significant challenges for many firms, there is no ‘golden bullet’. 

For those who have stalled in implementing ISQM 1, having the courage to take small steps, without fear of failure and with the support of others, is doubtless the way forward. Don’t forget that ICAEW offers a wealth of guidance to help firms.

Peter Herbert, Director, Insight Training
Jez Williams, Training Director, Apex Professional Consulting