ACCA Strategic Professional · Advanced Audit and Assurance (International)

Quality management (firm and engagement level): formula sheet

Full chapter guide

Key formulas

Risk-based process: Quality objectives → Quality risks → Responses; Firm sets objectives, identifies risks to achieving them, then designs and implements responses. Repeat as circumstances change.
Eight components: Risk assessment; Governance and leadership; Ethics; Acceptance and continuance; Engagement performance; Resources; Information and communication; Monitoring and remediation; List them in this logical grouping and tie each to the scenario.
Evaluation of the system: Evaluate at a specified date, at least annually, and conclude; The conclusion is that the system provides reasonable assurance, or that it does so except for matters identified, or that it does not.
Reasonable assurance: System gives reasonable assurance, not absolute assurance; Never say the system guarantees quality.
ISQM 1 components: Firm's risk assessment process; Governance and leadership; Relevant ethical requirements; Acceptance and continuance; Engagement performance; Resources; Information and communication; Monitoring and remediation; Use these as headings when a question asks about the firm's quality system. The first four are the focus of this topic.
Risk-based process: Quality objectives → quality risks → responses; Every ISQM 1 answer should show this chain. Do not list responses without naming the risk they address.
Accountability: Ultimate responsibility: CEO or managing partners. Operational responsibility: assigned to individuals with experience, authority and time; Operational responsibility covers the SoQM, independence compliance, and monitoring and remediation.
Threat categories: Self-interest, self-review, advocacy, familiarity, intimidation; Name the threat, explain it in the scenario, then give a safeguard.
Threat response hierarchy: Eliminate the circumstances; apply safeguards; or decline or end the engagement; Safeguards must reduce the threat to an acceptable level.
Acceptance and continuance factors: Integrity of client + competence, time and resources + ability to comply with ethical requirements + acceptable reason for engagement; Add conflicts of interest, money laundering risk and fee adequacy where the scenario supports them.
Resources component: three types: Resources = human + technological + intellectual (plus service providers where used); Use these headings to structure any answer on resources. Add service providers when the scenario mentions outsourcing or a network.
Human resources cycle: Recruit → Develop → Retain → Assign → Assess and hold accountable; Covers competence, capabilities and time. Match each engagement team to the complexity and risk of the engagement.
Engagement partner requirement: Partner needs competence + capabilities + sufficient time + clear role; Missing any one element is a quality risk, for example a partner who is overloaded with too many engagements.
Information and communication flows: Information system + internal communication + external communication; Communication should be timely and two-way. External parties include network firms, service providers, those charged with governance and regulators.
Quality risk response: Objective → Quality risk → Response; This is the logic behind ISQM 1. Write each answer point in this order for full marks.
When an EQR is required (ISQM 1): EQR needed if: listed entity audit OR required by law or regulation OR firm's criteria say the engagement merits one; The firm sets the criteria. They typically cover public interest, complexity and unusual risk.
Timing of the EQR: EQR completed BEFORE the report is dated; The engagement partner cannot date the report until the EQR is complete.
Eligibility of the reviewer: Competence + capabilities + authority + objectivity + not on the engagement team + not the engagement partner within the cooling-off period; ISQM 1 requires a cooling-off period of at least two years (or longer if law, regulation or ethical requirements demand) before the engagement partner can become the reviewer on that engagement.
Engagement partner responsibility (ISA 220 Revised): Overall responsibility for quality + sufficient and appropriate involvement throughout; The partner may assign tasks but remains responsible.
Team's approach to quality: Direction + supervision + review; Review must be done by more experienced team members and documented.
Audit quality framework (IAASB): Inputs + Processes → Outputs, shaped by key interactions and contextual factors; Use it as a checklist for factors affecting quality. Inputs cover people and values, processes cover methodology and review, outputs cover reports and communications. Key interactions cover dealings with management, those charged with governance, users and regulators. Contextual factors cover governance, law and reporting framework.
Engagement quality review: Independent review of significant judgements and conclusions, completed before the report is released (the report is not dated until the EQR is complete); ISQM 1 requires an EQR for listed entity audits, for engagements where law or regulation requires one, and for engagements where the firm determines an EQR is an appropriate response to its assessed quality risks. ISQM 2 covers the appointment, eligibility and performance of the reviewer, who must be objective and have the right competence.
Root cause response: Finding → Cause → Impact → Remediation; A structure for answering inspection and file review questions. Do not stop at the finding.

Quick revision

ISQM 1 requires a system of quality management that is risk-based, not a fixed checklist.
ISQM 1 applies to audits, reviews and other assurance or related services engagements.
The firm sets quality objectives, identifies and assesses quality risks, then designs and implements responses.
Governance and leadership set the culture. Leaders must be accountable for quality.
The firm must have policies on relevant ethical requirements, including independence, and must monitor compliance.
Acceptance and continuance decisions consider integrity of the client, competence, capability and resources.
Resources include people, technology and intellectual resources. Poor resourcing is a common quality risk.
Information and communication must flow both ways, within the firm and to external parties where needed.
Engagement performance covers direction, supervision, review, consultation and documentation.
ISQM 1 sets when an EQR is required. The criteria apply to all engagements: audits of financial statements of listed entities, engagements where law or regulation requires one, or engagements where the firm judges it is an appropriate response to quality risks.
ISQM 2 covers the appointment and eligibility of the reviewer and how the review is performed and documented. The EQR evaluates significant judgements and conclusions, and it must be completed before the engagement report is released. The engagement partner must not date the report until the EQR is complete.
The EQR reviewer must be objective, competent and have sufficient authority.
Monitoring identifies deficiencies. Remediation requires root cause analysis and follow-up.
Regulatory inspection findings should feed back into the firm's risk assessment and system.

Common mistakes

Describing ISQM 1 as a list of mandatory policies, as ISQC 1 was. Fix: Say the firm sets its own objectives, identifies and assesses its own risks and designs tailored responses.
Listing the eight components without applying them to the scenario. Fix: For each component named, quote a scenario fact and give a specific action the firm should take.
Listing ISQM 1 components without applying them to the scenario. Fix: Use the components only as headings. Every point must refer to a fact in the case.
Naming a threat but giving no safeguard, or a safeguard with no threat. Fix: Write threat, reason, safeguard as a set. Check that the safeguard really reduces that threat.
Listing every ISQM 1 resource heading without using the scenario. Fix: Pick only the facts shown in the scenario. Name the issue, the risk and the response for each.
Talking only about people and forgetting technological and intellectual resources. Fix: Scan the scenario for software, data tools, methodology or manuals. Cover each type that appears.
Saying the EQR is only for listed entities. Fix: State all three triggers: listed entity, law or regulation, and the firm's own criteria. Say the firm sets criteria for other engagements.
Treating the EQR as a second audit or a full file review. Fix: Say the EQR is an objective evaluation of significant judgements and conclusions. It is focused and is done before the report date.
Listing the framework headings without applying them to the scenario. Fix: Use the headings only to organise. Each point must cite a fact from the scenario.
Identifying a weakness but giving no recommendation. Fix: End every point with a practical action, and say who should do it.

Exam tips

Always tie the eight components to scenario facts. A bare list earns few marks.
Use the vocabulary: quality objectives, quality risks, responses, deficiency, root cause, reasonable assurance.
When a scenario shows a finding or failure, go straight to monitoring and remediation, and ask what the firm should do about the root cause.
Show professional skills: weigh the risk to audit quality against commercial pressure such as winning a client or keeping a deadline.
Keep ISQM 1 (firm), ISA 220 (engagement) and ISQM 2 (engagement quality review) separate in your answer.
Use the scenario facts in every sentence. Generic ISQM 1 lists score few marks.
Show the chain: risk or threat, why it matters, response. Markers look for all three.
In acceptance questions, cover integrity, competence and resources, ethical compliance, conflicts and fee. Add money laundering when the scenario hints at it.