Quality management and audit quality

Three standards, connected responsibilities

Quality management aims to make appropriate work and reporting repeatable. It requires leadership, resources and feedback that support sound decisions throughout the engagement. The system must fit the firm's actual work, complexity and risks; buying a standard manual does not demonstrate that it operates.

Concept sources: AUASB Bulletin — Quality Management Standards: Enhancing Audit Quality — pages 4–6 and 14–15; original comparison.

APES 320 governs quality management in Australian firms' non-assurance practices. A firm providing both assurance and advisory services must identify which requirements apply to each practice. APES 320's scope directs assurance practices to the AUASB standards and specifically includes agreed-upon procedures within its definition of assurance practice. Therefore, a service providing no assurance can still fall within ASQM 1's related-services scope.

Concept sources: APES 320 — Quality Management for Firms that provide Non-Assurance Services — February 2022 standard, paragraphs 1.1–1.10 and definition of Assurance Practice; effective 1 January 2023.

Eight connected components

ASQM 1 connects risk assessment, six areas of quality objectives and monitoring. Leadership retains ultimate accountability, including when the firm uses network services.

Risk assessment

Establish objectives, identify quality risks and design responses.

Governance and leadership

Make quality visible in decisions and accountability.

Relevant ethical requirements

Support compliance and respond to breaches.

Acceptance and continuance

Assess the client and the firm's ability to perform.

Engagement performance

Support direction, supervision, review and consultation.

Resources

Provide suitable people, technology and intellectual resources.

Information and communication

Get relevant information to the people who need it.

Monitoring and remediation

Find weaknesses and assess whether corrective action works.

Concept sources: ASQM 1 — Quality Management for Firms — December 2023 compilation, paragraphs 6, 19–33 and 48–52; original component summaries.

Turn an objective into a response

An objective describes the desired outcome. A quality risk explains how that outcome could fail. A response describes an action addressing the assessed risk. These are different statements: “staff training” is an action, not a clearly expressed objective or risk.

Start with the firm and its engagements. Rapid growth, an unfamiliar industry, concentrated deadlines or reliance on one specialist can change the risk assessment. Revisit it when circumstances change. A small firm can use simpler arrangements, but simplicity must follow from its circumstances rather than an assumption that quality requirements are optional.

Concept sources: Preparing for the New Quality Management Standards — Quality Objectives and Quality Risks — IFAC-hosted implementation article by Kirsten Albo; risk assessment and scalability; original study sequence.

Make responses observable

A response is useful when someone can explain who performs it, when it happens and what evidence shows completion. A training session may improve knowledge but cannot by itself create enough staff capacity. Similarly, a consultation policy is ineffective if the timetable leaves no time to consult.

The response should be proportionate to the identified weakness. Adding approvals everywhere can increase paperwork while leaving the original staffing or expertise problem unresolved. Connect each proposed action to the mechanism by which it is expected to improve quality.

Concept sources: Preparing for the New Quality Management Standards — ISQM 1 Risk Responses — tailored responses; original implementation explanation and example.

The engagement partner remains responsible

ASA 220 requires sufficient partner involvement throughout the audit. Responsibilities include ethical compliance, appropriate acceptance decisions, resources, direction and supervision, reviewing significant matters and judgements, consultation and resolution of differences. Tasks can be assigned, but overall responsibility remains with the partner.

Before dating the report, the partner makes the required overall assessment of involvement and the basis for significant conclusions. Firm monitoring findings must also be considered for their relevance to the engagement. A completed firm checklist does not answer whether a specific unresolved issue prevents the report from being dated.

Concept sources: ASA 220 — Quality Management for an Audit — paragraphs 13–41, including the overall assessment in paragraph 40.

Engagement quality review is a distinct role

An engagement quality reviewer evaluates significant judgements and conclusions objectively. The reviewer is outside the engagement team and must have suitable competence, capability, authority and time. A former engagement partner generally needs at least two years before becoming reviewer, with a longer period where relevant ethical requirements demand it.

The review occurs at appropriate stages, not merely after every other decision is settled. Unresolved concerns must be addressed; the engagement report cannot be dated before the required completion notification. Documentation must let an experienced practitioner understand the review work and conclusions. The review supports quality without taking over the engagement partner's decisions.

Concept sources: ASQM 2 — Engagement Quality Reviews — December 2023 compilation, paragraphs 17–30: eligibility, cooling-off, completion and documentation.

Monitoring, remediation and annual evaluation

Monitoring gathers evidence about the system. It includes completed engagement inspections, with partners covered on a cyclical basis. A finding is information requiring evaluation; it is not automatically a deficiency. A deficiency is a failure in the system that needs an appropriate response.

Investigate causes before choosing a remedy. If rushed reviews result from unrealistic scheduling, another reminder to “review carefully” will have limited effect. Evaluate severity and how widely the problem occurs, implement corrective action and check whether the action works. External inspections add information but do not replace internal monitoring.

Concept sources: Preparing for the New Quality Management Standards — System Evaluation and Monitoring — findings, deficiencies, inspection and remediation; original explanatory sequence.

Those ultimately responsible evaluate the system at least annually. Documentation supports operation and evaluation; retention must permit monitoring. Reviews are required for listed-entity audits, where law requires them, and for engagements selected to address quality risks. The firm also needs processes for complaints and allegations.

Concept sources: ASQM 1 — Quality Management for Firms — paragraphs 34, 53–60.

An annual documented independence confirmation is a required response for personnel who must be independent. Its purpose is to make compliance explicit; it must be supported by communication that helps people recognise and report relevant relationships.

Concept sources: AUASB Bulletin — Quality Management Standards: Enhancing Audit Quality — page 8, ethical compliance and annual confirmation.

Quality also depends on the surrounding environment

The IAASB's Framework for Audit Quality organises influences at engagement, firm and national levels. It supports analysis without replacing the applicable standards or proving that a particular audit was adequate.

Concept sources: A Framework for Audit Quality — IAASB Handbook Volume 4 — the 2014 framework reproduced in the 2023–2024 handbook, overview paragraphs 1–17 and contextual factors; original comparison.

Australia also uses external accountability. ASIC's transparency-report requirements apply to auditors meeting the specified threshold of ten or more relevant entities, rather than every audit firm. Reports explain matters including governance and quality systems. The relevant Corporations Act provisions are sections 332–332G.

Concept sources: ASIC — Audit transparency reports — INFO 184, August 2013, scope and statutory basis.

ASIC's study-era inspection reporting distinguishes a weak evidential basis for an audit opinion from a demonstrated misstatement in the financial report. Its files were selected using risk assessment, so findings cannot simply be extrapolated to every audit. The useful learning point is to investigate underlying causes and implement improvements, rather than treat inspection results as a league table.

Concept sources: ASIC reports on audit inspection findings for 12 months to 30 June 2022 — risk-based selection, interpretation and remediation.

Sources and further reading

AUASB quality-management resources link the Australian standards and international implementation publications. IAASB's updated ISQM 1 implementation guide announcement explains the guide's non-authoritative status and clarification of system-evaluation examples.