After a string of accounting scandals in recent years, the International Auditing and Assurance Standards Board (IAASB) has created a new set of quality management standards for the audit profession. The standards aim to strengthen and modernize audit firms’ approaches to quality management in response to the increasingly complex audit ecosystem.
The IAASB not only wants to ensure audits are being performed to the highest standard, but it also wants there to be global consistency, particularly for large multinational networks of member firms that undertake thousands of audit engagements each year. In addition, it wants to make sure firms are focusing on the quality of their audits over financial and operational priorities, such as market share or how much business a partner brings to the firm.
But while the new rules may seem more targeted to large audit practices and multinational accounting networks, they also apply to small and medium practices (SMPs).
A new approach
The Institute issued Hong Kong Standard on Quality Management (HKSQM) 1 Quality Management for Firms that Perform Audits or Reviews of Financial Statements, or Other Assurance or Related Services Engagements, and HKSQM 2 Engagement Quality Reviews in April this year. Both standards take effect from 15 December 2022, replacing the extant Hong Kong Standard on Quality Control (HKSQC) 1, and sees the revision of Hong Kong Standard on Auditing (HKSA) 220 Quality Control for an Audit of Financial Statements.
One of the biggest changes under HKSQM 1, as the standard’s name suggests, is a shift from quality “control” to quality “management,” according to Charbon Lo CPA (practising), Partner (Audit and Assurance), at Crowe (HK) CPA Limited. “Management includes planning, organizing, controlling, commanding and coordinating,” he says.
The new standard requires practices to put in place a robust quality management system that is tailored to the nature and circumstances of their own firm and the engagements it conducts.
Chris Joy FCPA, Executive Director, Standards and Regulation, at the Hong Kong Institute of CPAs, explains: “The revised quality management standards change how firms manage quality to enable a proactive, risk-based approach and higher quality engagements.” He adds that they are also not limited to practices conducting audits. “If practice units provide professional services such as audits or reviews of financial statements, or other assurance engagements or related services engagements, like agreed-upon procedures (AUP), or compilation engagements, they are required to design and implement their system of quality management by 15 December 2022.”
Lo points out that compared with HKSQC 1, which had six elements, HKSQM 1 has eight interrelated components covering a firm’s risk assessment process, governance and leadership, relevant ethical requirements, acceptance and continuance, engagement performance, resources, information and communication, and monitoring and remediation process. “The approach of the new standard is integrated, more proactive and tailored. The new standard requires firms to design their own policies and procedures tailored for the firms’ structure, operations, and the services they provide,” he says.
But he adds that not all of the quality objectives stipulated under HKSQM 1 will be applicable to every SMP. For example, quality objectives relating to the direction and supervision of staff will not be applicable to a sole proprietor.
Meanwhile, while many elements of HKSQM 2 come from HKSQC 1 and HKSA 220, the standard also includes new eligibility guidelines for the engagement quality reviewer (EQR), including a two-year cooling-off period before an engagement partner can be an EQR. “In addition, for audits of financial statements, it requires the EQR to evaluate the basis for the engagement partner’s determination that the relevant ethical requirements relating to independence have been fulfilled, and for all engagements, to evaluate whether appropriate consultation has taken place on difficult or contentious matters involving differences of opinion and the conclusions arising from those consultations,” Lo says.
He adds that the EQR also has to discuss with the engagement partner significant matters and judgements made in planning, performing and reporting on the engagement.
Getting started
Joy suggests the first thing SMPs should do in terms of implementing the new standards is to read them carefully to ensure they are thoroughly familiar with their content. “If practitioners have not already gained an understanding of the standards, they are strongly encouraged to read and understand them. Members should start to consider how the new requirements affect their practices and what needs to be revised,” he says.
The next step is for firms to design their own risk assessment process which takes into account their structure, operations and business lines to establish their quality objectives. Once firms have done this, they should identify the quality risks they face and design a response. “The new approach to quality is risk-based. The quality objectives set by the firm are outcome-based, as the firm determines how to achieve the quality objectives. Quality risks identified through the risk assessment process are tailored to the firm, given that the firm focuses on understanding conditions, events, circumstances, actions, or inactions, that relate specifically to the nature and circumstances of the firm and the engagements it performs,” Joy says.
He points out that the standard sets out very limited specified responses, although he adds that there are examples in the application material that demonstrate how to apply aspects of the standard to less complex and more complex firms.
Len Jui, Deputy Chair of the IAASB and Head of Public Policy and Regulatory Affairs at KPMG China, suggests a good place for firms to start is to look at their existing system of quality control, and match it to the objectives of HKSQM 1 to identify what is new. Lo adds: “Policies or procedures under the existing quality control manual that are only partially meeting the HKSQM 1 requirements should be enhanced in order to meet the new requirements. Firms should then add requirements that are not in their existing quality control manual in order to comply.”
Michelle Chu CPA (practising), Assurance Director, Moore Hong Kong, suggests firms should set up a task force to design and implement the new quality management system. “The task force should involve members from different departments. Mapping between your firm’s existing quality control manual and the new requirements under the HKSQMs,” she says.
Leadership also has a key role to play, particularly in SMPs. Lo explains that the new standard regards the firm as a whole, and while it may have different business lines with different management, the project must be driven from the top.
Jui points out that leaders at SMPs also tend to be more hands-on due to their simpler management structure. “It is likely the leaderships of the SMPs will be directly involved in all aspects of implementation of system of quality management at each component level,” he says.
Assessing risk
A key part of implementing HKSQM 1 involves identifying risks and putting in place a response to mitigate them. “The risks are factors, both internal and external, that may prevent firms from meeting the quality objectives,” Lo explains. He gives the example of a firm auditing a client in the mining industry having to make sure it has enough experienced partners or staff to perform the engagement. Having identified this risk, the response might be to hire more experienced staff or engage external parties.
Chu adds that firms should also be aware that the definition of a quality risk under HKSQM 1 is a risk that has a reasonable possibility of occurring and which, either individually or in combination with other risks, could adversely affect the achievement of one or more quality objectives. “In the risk assessment process, a firm should think about its nature and characteristics and how they may prevent the firm from achieving the established quality objectives. These include conditions, events, circumstances, actions and engagements, which are critical to the firm,” she says.
Chu adds that it is important for SMPs to think about the size of their firm, its structure and its number of locations, as well as whether processes are centralized or decentralized, and whether service delivery centres or other external resources are used, when identifying risks.
“It is likely the leaderships of the SMPs will be directly involved in all aspects of implementation of system of quality management at each component level.”
Potential challenges
Lo thinks one of the main pitfalls SMPs may run into when setting up their quality management systems is failing to establish the quality objectives their system needs to achieve at the outset. They must also ensure the quality risks they identify relate to these objectives.
“Another pitfall is that the responses designed do not reduce the likelihood of a related quality risk occurring to an acceptably low level because the responses are not properly designed, implemented or operated efficiently,” he says. Lo adds that to overcome these potential challenges, firms should test their new policies and procedures before the new standards come into force.
Jui agrees: “The key challenge for the SMPs will be identifying quality objectives at the front end of the implementation. This is something we have heard from SMPs in other regions of the world, and it is expected to be the same challenge in the Hong Kong and Mainland markets.”
Lo warns that having sufficient resources could be an issue for SMPs, due to the upfront investment in training or hiring that may be required to conduct the risk assessment at the start of the implementation process, as well as to perform ongoing monitoring and remediation procedures once the system is in place. “Competency and capability is the one area that firms large and small are struggling with. It is important for the firm’s leadership to have a plan to address this challenge rather than just reassign staff from elsewhere in the firm to take on the system of quality management implementation,” Jui says. “Another challenge I often hear about for SMPs is in monitoring, and having the appropriate objectivity to perform monitoring activities, which also comes back to human resources.”
He adds that initial feedback on HKSQM 2 suggest SMPs may also face more challenges than larger firms in identifying qualified EQRs. As a result, Jui says it is important for SMPs to think about who will be assigned to these roles and responsibilities, and how firms will build up their competence and capabilities.
Chu points out that while there are service providers in the market who can help firms design policies and procedures that comply with the new standards, they are unlikely to understand the firm as well as the leadership team, who will ultimately be responsible and accountable for the framework. “They may provide insights and you can adopt some of their suggestions, but you still have to establish your own quality objectives, identify the risks and design the response in accordance with your firm’s own structure, business line and the environment it faces,” she says.
Chu also reminds SMPs that preparing for the new standards is not a one-off exercise, as HKSQM 1 must be re-evaluated at least once a year, and more frequently if the firm’s operations or the business environment changes. She gives the example of COVID-19 travel restrictions, which have meant Hong Kong firms auditing Mainland entities have not been able to go onsite. “If there are similar cases in the future, the policies and procedures will have to be updated. The process is very dynamic,” she says.
Jui agrees: “I would like to stress that quality management system implementation is a continuous improvement process and requirement. Some practitioners may consider it as one-time compliance project, which contradicts the spirit of the HKSQM 1 and the regulatory expectations.”
“Some practitioners may consider it as one-time compliance project, which contradicts the spirit of the HKSQM 1 and the regulatory expectations.”
No time to lose
SMPs are urged to start preparing for the new standards as soon as possible. Lo says: “This project is a big one. The bigger the firm, the more involvement is required to prepare for the new quality management system. Firms have to start preparing and planning now.”
He suggests firms should consider taking a phased approach to implementing the new requirements, trialling some of the additional requirements during the first quarter of 2022 and adding additional ones during the second quarter, before refining policies and procedures based on the trial results in the third quarter.
Chu adds that as the implementation of the new quality management system will likely add to the workload of staff, they may require additional support, while SMPs may also need to invest in technology and other resources to help them develop the system.
“This project is a big one. The bigger the firm, the more involvement is required to prepare for the new quality management system.”
The Institute has set up a resources webpage to help firms prepare for the new standards. It includes two guides, the IAASB ISQM 1 First-Time Implementation Guide and the IAASB ISQM 2 First-Time Implementation Guide, which detail the basic requirements of the new standards, and include examples from business situations that firms can reference to help them develop their own quality management systems. There is also guidance from the Institute’s Auditing and Assurance Standards Committee.
The IAASB has also issued factsheets on the standards and introductory videos providing overviews of each standard, which are available in English, French, Mandarin and Spanish. In addition, it has created a four-part webinar series taking a deep dive into ISQM 1.
Meanwhile, the Institute is currently working on a revised version of its Quality Management Manual to assist members in designing and implementing their own quality management system.
Joy adds that to help SMPs understand HKSQM 1, the Institute is also arranging a series of webinars in Cantonese during the first half of 2022. “The Institute, through its various events and publications, has been alerting members to start the implementation process as early as possible.”
HKSQM 1 Quality Management for Firms that Perform Audits or Reviews of Financial Statements, or Other Assurance or Related Services Engagements, and HKSQM 2 Engagement Quality Reviews take effect from 15 December 2022. The standards encourage firms to adopt a robust and proactive approach to quality management. Read more about the standards in the March 2021 issue of A Plus.
