ISQM1, the International Standard on Quality Management, becomes effective on 15 December 2022. This new standard requires firms to design a system of quality management, incorporating components that are highly integrated and operate together continuously.
The new and revised components also include enhanced changes to the monitoring and remediation process, which is the process that monitors the firm’s system of quality as a whole.
This process can be broken down into four stages:
Stage 1: The design and performance of monitoring activities
The design and performance of monitoring activities is one that needs to be both periodic and ongoing. The process would involve the monitoring of all components within the system, therefore monitoring of the firm’s governance and leadership, compliance with relevant ethical requirements, acceptance and continuance procedures, engagement performance, resources and information and communication.
Such process would involve a firm assessment to understand what factors the firm wishes to monitor through its inspections that are being carried out. For example, should a firm note that engagement team members are not consulting enough during their engagements, then such factor would need to be considered, specifically when carrying out inspections on engagements.
The firm therefore needs to consider the environment in which it is operating and how such environment is affecting the design of the monitoring of those activities. Consideration of the nature, timing and extent of monitoring procedures would also need to be assessed.
Factors that could affect the nature, timing and extent of a firm’s monitoring activities include the following:
- The size and structure of the firm
- Resources to be used within the firm
- Reasons for the assessments given to quality risks within the risk assessment process
- The design of firm responses to quality risks identified
- The design of the firm’s risk assessment process and the monitoring and remediation process
- Changes in the system of quality management
- Previous monitoring activities, along with the effectiveness of remedial actions
- Whether the firm forms part of a network
- Other relevant information, such as complaints and allegations, external inspections and service providers.
Monitoring activities need to be tailored to address firm circumstances.
Furthermore, operational responsibility for the process of monitoring and remediation within the firm needs to be assigned to someone within the firm, with this person holding the appropriate experience, time, influence and authority to be able to perform this role.
In selecting engagements for review, both engagements to be reviewed and engagement partners who reviewed such engagements would need to be considered. The firm would accordingly need to determine the cycle for the selection of engagement partners and corresponding files and assess how often such engagements would be subject to review.
Stage 2: The evaluation of findings and the identification of deficiencies, along with the evaluation of identified deficiencies
Following the design and performance of monitoring activities, the next step in the monitoring and remediation process would involve the evaluation of findings, the identification of deficiencies and the evaluation of identified deficiencies. Findings provide information about the design, implementation and operation of the system of quality management which indicates that one or more deficiencies may exist. Such information would mainly emanate from the monitoring activities performed and any external inspections held.
The evaluation of findings by the firm would help to determine whether any deficiencies exist.
Following this evaluation, the firm would then need to evaluate the severity and pervasiveness of the deficiencies identified, while continuously applying professional judgement during the process.
Once the severity and pervasiveness of the deficiencies identified have been evaluated, then investigation of the root cause of such deficiency would need to be established. This would need to include the effect of such deficiencies, individually or in the aggregate, on the SOQM.
Stage 3: Responding to identified deficiencies
The third stage within a firm’s monitoring and remediation process would involve:
- The design and implementation of remedial actions.
This would include the firm’s response to the root cause of the identified deficiencies, while also responding to findings on engagements that highlight any omitted procedures during audits carried out or the issue of an inappropriate report.
- The evaluation of remedial actions
This stage in the process would assess whether remedial actions have been appropriately designed to address the identified deficiencies and their related root causes and understand whether such remedial actions have been implemented. Furthermore, it will include the assessment of implemented remedial actions for previous deficiencies to understand whether these have been identified.
- And taking appropriate action.
Such will apply in cases where remedial actions are not appropriately designed, not implemented, or not effective.
Stage 4: Communication
The final stage within the monitoring and remediation process includes the communication of results. Such requirement includes communication between the person responsible for the monitoring and remediation process and the person assigned individual operational responsibility for the system of quality management.
The standard also requires communication of results of monitoring activities to other persons within the firm, including engagement partners, engagement team members and others within the system. It is imperative that communication is carried out in a manner that enables people to respond and take prompt and appropriate action, where necessary.
While ISQC 1 required communication to take place on an annual basis, ISQM 1 emphasizes the need for communication to take place on a timely basis. This will allow the firm to communicate the right information to the right people at the right time.
Finally, ISQM 1 requires annual performance evaluations to be carried out on the system of quality management. Such evaluations would include the assessment of how individuals responded and reacted to identified deficiencies, actions taken by personnel in response to remediated deficiencies, as well as an assessment of how the firm responded to the monitoring and remediation process. The results of such evaluation will provide the firm with key insights into the performance of responsible persons for the system of quality management.
Should you require further information or assistance in relation to the implementation of ISQM 1, please get in touch with Janis Hyzler on jh@zampadebattista.com. Our assistance goes beyond an advisory role and could also include the fully fledged drafting of policies and procedures in line with the requirements of ISQM 1.
Please note that this article is being published for information purposes only. As such, it does not constitute or should not be interpreted or construed as legal advice or guidance. ZD does not accept responsibility or liability for any damages arising as a result of using this information as legal advice or guidance.
