Insight Training’s June 2023 ISQM seminar gave us the chance to explore in more detail the practical implications of ISQM 1. Also on the agenda were the other two new/revised standards, which make up the suite of quality management standards currently coming into effect: ISQM (UK) 2 ‘Engagement Quality Reviews’ and ISA (UK) 220 Revised ‘Quality Management for an Audit of Financial Statements.’

The seminar was run in conjunction with our good friends Jez Williams from Apex and Edward Rands from ECR Professional. Here are some of the questions that cropped up:

When do these revised standards take effect?

Both ISQM (UK) 2 and ISA (UK) 220 take effect from periods commencing 15 December 2022, which is the same date that ISQM (UK) 1 took effect.

I’ve heard that ISQM 2 isn’t applicable to many smaller firms. Is this true?

It’s actually ISQM (UK) 1 paragraph 34 that explains when an Engagement Quality Review (EQR) is required. Although the devil’s in the detail, EQRs will generally be needed for listed entity and public interest entity audits, which will mean that, for many smaller firms not operating in this space, ISQM (UK) 2 won’t technically apply.

What are the important rules for Engagement Quality Reviews (EQRs)?

ISQM (UK) 2 lays down eligibility rules for EQ reviewers and explains how an EQR should be performed and documented. Important aspects that have cropped up are:

• EQRs need to be performed ‘at an appropriate time’ during the audit process, which will require involvement at the planning stage as well as at completion;
• Important matters and judgements actually have to be discussed with the engagement partner, which means that a purely tick box approach won’t be sufficient;
• There are specific rules about what needs to be documented when an EQR is performed; and
• There are ‘cooling off rules’ requiring careful thought, which can prevent a senior member of the engagement team being appointed EQ reviewer as soon as they are rotated off the audit team. Paragraph 19 of ISQM (UK) 2 provides more detail.

What’s the difference between an EQR and a second partner review?

The purpose of a second partner review might be similar to an EQR. In practice, such reviews have a variety of additional names (e.g. hot review / consultation review). Such reviews are often performed when there are contentious issues affecting an audit, or independence threats, for example, as a result of long association. However, although the approach might be broadly the same, such a review will not be subject to the detailed requirements of ISQM (UK) 2.

Do you need to be a responsible individual to carry out an EQR?

Not unless the firm’s internal policies and procedures require it. Paragraph 18.1 of ISQM (UK) 2 states that an EQ reviewer must be ‘eligible for appointment as a statutory auditor.’ Guidance issued by the FRC in March 2023 interprets this as the EQ reviewer being a member of a Recognised Supervisory Body (RSB)  and holding an appropriate audit qualification. It is not imperative that the individual concerned is a responsible individual.

What involvement can an EQ reviewer have in the actual conduct of an audit?

As noted above, the requirements of ISQM (2) require the EQ reviewer to genuinely engage with the process but care is required. If the EQ reviewer gets too ‘hands on’ with the actual conduct of the audit, this might undermine their role as an independent reviewer. Paragraph 18.1 of ISQM (UK) 2 specifically states that the EQ reviewer must not be ‘involved in the performance of the audit to which the EQR relates.’ To ensure that this line isn’t crossed, many firms prohibit EQ reviewers from attending client meetings.

Given all this confusing language, should we just not treat all second partner reviews as EQRs?

There is certainly merit in firms limiting the different names used for reviews of this type. However, badging consultation reviews conducted in the light of independence threats as ‘EQRs’ means that all the detailed requirements of ISQM (UK) 2 outlined above will apply. It would thus perhaps be better to have two categories of review – ‘full’ EQRs, as required by the standard, and other consultation reviews.

The introduction of ISQM (UK) 2 provides firms with an excellent framework for creating policies and procedures for appointing, performing and documenting consultation reviews – as well as full EQRs.

Can we hand off to an external organisation for reviews of this type?

It is possible to use service organisations for reviews of this type. However, firms are reminded that responsibility for audit quality rests with them and that they need to think hard about whether an appointed service organisation would have the skills, resources and time to conduct such a review to the standard that the firm requires.

If you do intend to use an external service organisation to perform such a review, then make contact early. Demand for reviews is at an all-time high and – given the need for involvement at different stages of the audit process – careful scheduling is needed from both sides.

Does ISA (UK) 220 revised actually change much apart from terminology?

Where good procedures exist within firms to ensure good quality outcomes for individual audits, it is likely that in practical terms ISA (UK) 220 will actually change little. Key themes discussed during our recent seminar were:

• The engagement partner must take responsibility for setting the tone, spelling out responsibilities and directing and supervising the conduct of the audit throughout the process;
• All members of the audit team must take responsibility for the effective conduct of the audit and exhibiting appropriate professional scepticism; and
• There must be sufficient evidence of engagement partner review and it can be difficult to get the balance right here (‘not too much; not too little’).

One area where changes will be more appreciable is for group audits where component audit work is performed by other firms. Component audit teams are very much part of the group audit team under the revised ISA and careful thought will need to be given to relevant messaging and supervision.

Is there a link between ISA (UK) 220, ISQM (UK) 2 and ISQM (UK) 1?

Definitely. ISA (UK) 220 and ISQM (UK) 2 address quality at the individual audit level. EQRs and consultation reviews can be hugely beneficial in harnessing good quality audit outcomes and in that sense we would encourage auditors to see the standards in a positive light rather than just giving rise to burdensome procedures to adopt. This in turn helps to deliver good outcomes at an overall firm level which means that what we’re talking about contributes significantly to an effective overall system of quality management (SoQM).

Should my firm be early adopting these new standards?

Why not?! In view of the positive impact that ISA (UK) 220 and ISQM (UK) 2 processes can have on audit quality, don’t just wait until 31 December 2023 year ends. We also consider the changes here to be an ‘evolution not a revolution’ so many firms will already be doing much of what they need to do in order to be compliant.

Peter Herbert

July 2023