Advanced Audit and Assurance (International) · International regulatory frameworks for audit and assurance services

ISQM 1, ISQM 2 and ISA 220 Quality Management Explained

Updated 11 October 2026 · Fact-checked

ISQM 1 requires a firm to design, implement and operate a quality management system based on risk. ISQM 2 sets rules for engagement quality reviews. ISA 220 (Revised) sets the engagement partner's responsibilities for quality on an audit. To answer questions, link each point to the scenario's quality risk and respond.

Understand Quality Management Standards (ISQM 1, ISQM 2 and ISA 220)

Quality management works at two levels. The firm sets up a system. Each engagement team then applies it. ISQM 1 covers the firm. ISA 220 (Revised) covers the audit engagement. ISQM 2 covers one specific response: the engagement quality review.

ISQM 1 replaces a checklist approach with a risk-based one. The firm sets quality objectives, identifies and assesses quality risks that could stop those objectives being met, and designs responses to address them. The system is a continuous cycle, not a one-off exercise.

ISQM 1 has eight components: the firm's risk assessment process; governance and leadership; relevant ethical requirements; acceptance and continuance of client relationships and specific engagements; engagement performance; resources; information and communication; and the monitoring and remediation process. The eight components operate together as an integrated system. The risk assessment process is the process through which the firm sets quality objectives, identifies quality risks and designs responses. Governance and leadership supports the culture the system depends on.

The firm must assign ultimate responsibility and accountability for the system to the chief executive or managing partner (or the managing board of partners). It must also assign operational responsibility for the system, for compliance with independence requirements, and for monitoring and remediation. At least annually, the person with ultimate responsibility must evaluate the system and conclude on whether it provides reasonable assurance that its objectives are achieved.

ISA 220 (Revised) makes the engagement partner responsible for the overall management and achievement of quality on the engagement. The partner must be sufficiently and appropriately involved, set the tone, ensure ethical and independence compliance, ensure the team has appropriate resources, direct and supervise the team, review its work, and take responsibility for appropriate consultation on difficult or contentious matters. The partner may assign tasks to others but remains responsible.

ISQM 2 applies where an EQR is required. ISQM 1 requires the firm to require an EQR for audits of listed entities, for engagements where law or regulation requires one, and for engagements where the firm determines that an EQR is an appropriate response to one or more assessed quality risks. The reviewer is not part of the team. They must be objective and have the competence, capacity and authority needed. They evaluate the significant judgements made and the conclusions reached. The engagement partner must not date the auditor's report until the engagement quality reviewer has notified the partner that the EQR is complete.

Key rules to remember

ISQM 1 system components: Risk assessment process + governance and leadership + ethics + acceptance and continuance + engagement performance + resources + information and communication + monitoring and remediation; Eight components that operate together as an integrated system. The risk assessment process is how objectives, risks and responses are set. Governance and leadership supports the culture.
Risk-based cycle: Quality objectives → quality risks → responses → monitoring → remediation; Use this chain to structure any ISQM 1 answer.
Responsibility at the top: Ultimate responsibility = chief executive or managing partner (or managing board of partners); The firm also assigns operational responsibility for the system, independence, and monitoring and remediation.
Annual evaluation: Evaluate the system at least annually and conclude whether it gives reasonable assurance; Done by the person with ultimate responsibility.
Engagement partner under ISA 220 (Revised): Partner is responsible for overall quality, even where tasks are assigned to others; Covers involvement, ethics, resources, direction, supervision, review, and consultation.
EQR timing: No audit report date until the engagement quality reviewer has notified the partner that the EQR is complete; The review is done before the report is dated, not afterwards. The reviewer's completion notification is what releases the date.
EQR required for: Listed entity audits + engagements required by law or regulation + engagements where the firm determines an EQR is an appropriate response to one or more assessed quality risks; For the last category, the firm sets its criteria based on its assessed quality risks.

How to solve Quality Management Standards (ISQM 1, ISQM 2 and ISA 220) questions

Quality management questions are scenario-based. Match the facts to a component or ISA 220 duty, then explain the weakness and the fix.

1Read the requirement. Decide if it asks about the firm (ISQM 1), the engagement (ISA 220), or the review (ISQM 2).
2Underline facts in the scenario that signal a quality risk, such as a new client, a rushed deadline, a junior team or a close relationship.
3Name the relevant component or duty, for example resources, acceptance and continuance, or partner direction and review.
4Explain why the fact is a quality risk. Say what could go wrong with the audit or the firm's compliance.
5Give a specific response: a procedure, a person, a policy or a review. Make it fit the scenario.
6Add monitoring and remediation where relevant. Mention root cause analysis and who is told of deficiencies.
7Finish with a short conclusion or recommendation. Use a clear, professional tone to earn skills marks.

Quickest way: Risk, response, responsibility

When to use it: Use when time is short and the question asks you to identify problems or recommend actions in a scenario.

Tag each scenario fact with a component: ethics, resources, acceptance, performance, monitoring.
For each tag write one line: the risk, then the response, then the person responsible.
If the entity is listed or high risk, check whether an EQR is needed and who should do it.
Add one line on documentation of the judgement made.

Common mistakes in Quality Management Standards (ISQM 1, ISQM 2 and ISA 220)

Describing ISQM 1 as a list of procedures rather than a risk-based system.
Older quality control standards were rules-based, so students recall a checklist.
Fix: Always start from quality objectives and quality risks, then link responses to those risks.
Confusing ISQM 1 with ISQM 2.
Both mention quality and reviews.
Fix: ISQM 1 is the whole firm system. ISQM 2 only covers appointing and performing engagement quality reviews.
Saying the EQR reviewer helps prepare the audit or can be the partner's colleague on the team.
Students think review means extra supervision.
Fix: The reviewer is outside the engagement team, objective and independent. They evaluate significant judgements, not do the audit.
Saying the engagement partner is no longer responsible once work is delegated.
Students mix up assigning tasks with transferring responsibility.
Fix: Under ISA 220 (Revised) the partner stays responsible for overall quality. Explain how they direct, supervise and review.
Stopping at monitoring and ignoring remediation.
Monitoring feels like the final step.
Fix: Add evaluation of findings, root cause analysis, and corrective action. Say who is informed of the results.
Giving generic answers that could fit any firm.
Students recall theory but do not apply it.
Fix: Name the scenario facts and tie each point to them. Professional skills marks reward application.

Worked examples

Example 1

A mid-sized firm has accepted a new listed client at short notice. The audit team has two inexperienced staff, and the engagement partner is also leading three other audits with the same year end. Explain the quality risks and the responses the firm and partner should make.

Show the solution

Identify the firm-level risk: acceptance and continuance. Short notice may mean the firm did not assess the client's integrity or its own capacity and competence.
Response: complete client acceptance procedures, including ethical and independence checks, before the engagement starts.
Identify the resource risk: inexperienced staff on a listed client, and a partner with limited time.
Response: assign more experienced staff or an additional manager, and ensure the partner has enough time to be properly involved. The firm may need to reallocate partners.
Identify the engagement performance risk: weaker direction, supervision and review.
Response: under ISA 220 (Revised) the partner must direct and supervise the team and review key work. Plan early reviews of high-risk areas.
Note that the entity is listed, so ISQM 1 requires an EQR. The reviewer must be outside the team and have the competence, capacity and authority.
Conclude that the partner must not date the report until the reviewer has notified the partner that the EQR is complete and any significant issues are resolved.

Answer: The main quality risks are weak acceptance procedures, insufficient resources, and inadequate partner involvement. Responses include completing acceptance checks, adding experienced staff, ensuring the partner has capacity, and performing an EQR, which ISQM 1 requires for a listed entity, before the report is dated.

Example 2

An inspection finds that several audit files lack evidence of review by the partner. The firm's managing partner says the issue is an isolated error by one team and will be handled informally. Advise the firm on its obligations under ISQM 1.

Show the solution

Identify the component: monitoring and remediation. The firm must monitor the system and evaluate deficiencies it finds.
The firm should not assume the issue is isolated. It must investigate the cause of the findings, including whether it extends beyond one team.
Perform a root cause analysis. Possible causes include partner workload, unclear review policies, or weak supervision of the file closure process.
Evaluate the severity and pervasiveness of the deficiency. This tells the firm how serious it is for the system.
Design and implement remediation, such as clearer review procedures, training, and extra supervision of the affected engagements. Consider whether the affected audits need further work.
Communicate the findings to engagement teams and to those with operational and ultimate responsibility. Informal handling is not enough.
At least annually, the person with ultimate responsibility must evaluate the system and conclude whether it gives reasonable assurance. This deficiency must be considered in that evaluation.

Answer: The firm must evaluate the deficiency, find its root cause, remediate it, and communicate it. It cannot treat it as an informal one-off matter. The finding must also feed into the annual evaluation of the quality management system.

Exam tips

Link every ISQM 1 point to a risk in the scenario. Pure theory rarely earns full marks.
When an EQR is mentioned, cover who is reviewing, what they evaluate, and that the report date waits for the review.
Use component names as headings in your answer plan to stay organised, then write full sentences.
Use the professional skills marks: give clear recommendations, show scepticism and keep a measured tone.
Do not quote paragraph numbers. Explain the requirement in plain words and apply it.

Practice questions from International regulatory frameworks for audit and assurance services

Quality Management Standards (ISQM 1, ISQM 2 and ISA 220): frequently asked questions

What is the difference between ISQM 1 and ISQM 2?

ISQM 1 covers the firm's whole quality management system. ISQM 2 covers engagement quality reviews only. It sets who may be the reviewer and what the review must evaluate.

What does ISA 220 (Revised) require of the engagement partner?

The engagement partner is responsible for the overall management and achievement of quality on the audit. They must be sufficiently and appropriately involved, ensure ethical compliance, ensure adequate resources, and direct, supervise and review the team.

When is an engagement quality review required?

An EQR is required for audits of listed entities, for engagements where law or regulation requires one, and for engagements the firm's own policies identify as needing one because of quality risk. The firm sets its criteria in its risk responses.

How do I write an engagement quality review answer?

State that the reviewer is independent of the team and has competence, capacity and authority. Say they evaluate significant judgements and conclusions, and that the report is not dated until the review is complete. Then apply this to the scenario's risks.