Advanced Audit and Assurance (International) · Professional appointments

Quality Management at Firm Level (ISQM 1) for ACCA AAA

Updated 11 October 2026 · Fact-checked

ISQM 1 requires a firm to design, implement and operate a system of quality management for audits, reviews and other assurance engagements. The firm sets quality objectives, identifies and assesses quality risks, designs responses, and monitors them. In AAA, apply each component to the scenario facts, including client acceptance and continuance.

Understand Quality Management at Firm Level (ISQM 1)

ISQM 1 is the IAASB standard that applies to the firm. It covers firms that perform audits or reviews of financial statements, or other assurance or related services engagements. It does not tell you how to do one audit. It tells the firm how to run itself so that all its engagements reach a good standard.

The firm must design, implement and operate a system of quality management (SoQM). The standard is risk-based and proactive. The firm sets quality objectives, identifies quality risks that could stop those objectives being met, then designs responses to address those risks. The firm does not simply follow a fixed checklist. It must tailor the system to its own size, clients, services and structure.

The SoQM has eight components. Governance and leadership and the firm's risk assessment process form the foundation. Governance and leadership sets the culture and accountability, and the risk assessment process drives the objectives, risks and responses. The other components are relevant ethical requirements, acceptance and continuance of client relationships and specific engagements, engagement performance, resources (which include human, technological and intellectual resources), information and communication, and the monitoring and remediation process. Monitoring and remediation feeds back into the rest of the system, because what it finds can change the risks and responses. You should be able to name all eight and give one example of each.

Appointment decisions sit in the acceptance and continuance component. The firm must set objectives so that it only takes on or keeps work when it is competent and has the time and resources, can comply with ethical requirements including independence, and has considered the integrity of the client and the quality risks of the engagement. If it finds an issue after acceptance, it must have a process to decide whether to withdraw.

The firm must assign ultimate responsibility and accountability for the system to the firm's CEO or managing partner (or equivalent) or, if appropriate, the managing board of partners. These individuals must evaluate the system. The evaluation must be performed at a specified point in time and then at least annually. Where applicable, the individual with operational responsibility for the system takes part too. They then conclude that one of three things is true:

The system provides reasonable assurance that its objectives are achieved.
Except for matters giving rise to deficiencies that are severe but not pervasive, the system provides reasonable assurance.
The system does not provide reasonable assurance, because deficiencies are severe and pervasive.

ISQM 1 sits beside ISQM 2, which covers engagement quality reviews, and ISA 220 (Revised), which covers quality management at the level of one audit engagement. ISQM 1 is for the firm. ISA 220 is for the engagement partner and team.

Key rules to remember

Eight components of the SoQM: Risk assessment process; Governance and leadership; Relevant ethical requirements; Acceptance and continuance; Engagement performance; Resources; Information and communication; Monitoring and remediation; Use these as headings when a scenario asks about weaknesses in a firm's quality system.
Risk-based process: Quality objectives → quality risks → responses; The firm must set objectives, identify and assess risks to achieving them, then design and implement responses to address those risks.
Acceptance and continuance judgement: Integrity of client + competence, time and resources + ability to comply with ethics and independence; These three areas drive an appointment decision. Add the specific quality risks of the engagement.
Annual evaluation: Evaluate the SoQM at a specified point in time, then at least annually, and conclude: (a) reasonable assurance; (b) reasonable assurance except for matters that are severe but not pervasive; or (c) no reasonable assurance, because deficiencies are severe and pervasive; The conclusion is made by the individual(s) assigned ultimate responsibility and accountability for the system and, where applicable, the individual with operational responsibility.
Scope distinction: ISQM 1 = firm level; ISQM 2 = engagement quality review; ISA 220 (Revised) = engagement level; This is the usual answer to the question on how the standards differ.

How to solve Quality Management at Firm Level (ISQM 1) questions

Use this method for any question on firm-level quality management. It keeps your answer tied to the scenario and earns professional skills marks.

1Read the requirement and note the verb. Explain, evaluate, recommend and advise need different depths.
2Identify the level. Decide whether the issue is firm-wide (ISQM 1), one engagement (ISA 220) or a review of a specific engagement (ISQM 2).
3Map each scenario fact to a component of the SoQM, for example a partner overloaded with clients points to resources.
4State the quality risk that the fact creates. Say what could go wrong, such as inadequate supervision or a missed independence threat.
5Recommend a specific response the firm should put in place, such as a client acceptance review, a training programme or a root cause analysis.
6For appointment questions, assess integrity, competence and resources, independence and ethics, and engagement risk, then reach a clear accept, decline or continue decision.
7Link to monitoring. Say how the firm would detect and fix the problem, and who is accountable.
8Finish with a short conclusion that answers the requirement directly.

Quickest way: Component-and-risk scan

When to use it: Use when time is tight and the scenario lists several quality concerns in a firm.

Underline each concern in the scenario as you read.
Write the component name beside each concern in the margin.
For each, write one line on the risk and one line on the response.
Write the answer in that order, one short paragraph per component.
Add a one-line conclusion on whether the system is likely to give reasonable assurance.

Common mistakes in Quality Management at Firm Level (ISQM 1)

Confusing ISQM 1 with ISA 220 (Revised).
Both deal with quality, and students treat them as one topic.
Fix: Say ISQM 1 is the firm's system and ISA 220 is the engagement partner's responsibilities on one audit. Name the level before you answer.
Listing the eight components without applying them.
Students memorise the list and write it as a recall answer.
Fix: Use each component only where a scenario fact points to it. Explain the risk and a response for that fact.
Describing the old ISQC 1 approach of policies and procedures.
Older notes still use the previous standard.
Fix: Use the risk-based language of quality objectives, quality risks and responses. ISQM 1 replaced ISQC 1.
Treating appointment as only a question of independence.
Ethics is the most familiar issue in client acceptance.
Fix: Also cover client integrity, firm competence, time and resources, and the risk profile of the engagement.
Ignoring monitoring and remediation.
Students stop once they have recommended a control.
Fix: Add how the firm will find deficiencies, investigate root causes and fix them. Mention the annual evaluation where relevant.
Giving generic advice that could fit any firm.
Students rely on memorised points under time pressure.
Fix: Quote the scenario facts, such as firm size, sector or staff turnover, and tailor each response to them.

Worked examples

Example 1

Delta & Co is a small audit firm with three partners. It has just accepted a listed client in a new sector. The engagement partner has no experience of the sector, and two audit seniors have left. Explain which components of the system of quality management under ISQM 1 are affected and recommend responses.

Show the solution

Level: this is a firm-wide issue because it concerns acceptance decisions and staffing, so ISQM 1 applies.
Acceptance and continuance: the firm accepted a listed client without confirming competence in the sector. The quality risk is that it cannot perform the audit properly. Response: require a documented acceptance review that considers competence, time and resources before approval.
Resources: the loss of two seniors reduces human resources. The risk is poor supervision or rushed work. Response: recruit or second staff, use experienced contractors, or delay acceptance until capacity exists.
Resources again: the partner lacks sector knowledge. Response: provide training, assign a sector expert for consultation, and consider an experienced second partner.
Engagement performance: the risk is weak direction and review. Response: set up a consultation process and increased review for this engagement.
Engagement quality review: ISQM 1 requires the firm to have policies that call for an engagement quality review on audits of financial statements of listed entities, so one is required here. It also requires one for other engagements where law or regulation requires it, or where the firm determines a review is an appropriate response to assessed quality risks. ISQM 2 then governs the appointment and eligibility of the reviewer and how the review is performed.
Monitoring: include the engagement in the firm's inspection of completed engagements and review whether the acceptance process failed.

Answer: The facts mainly affect acceptance and continuance and resources, with knock-on effects for engagement performance and monitoring. The firm should have assessed competence and capacity before accepting. It now needs sector training or expertise, extra staff, stronger review and an engagement quality review, which ISQM 1 requires for a listed entity (and also where law or regulation requires one, or where the firm decides one is an appropriate response to assessed quality risks) and ISQM 2 governs in performance. It should also fix the acceptance process so this cannot recur.

Example 2

A partner at Orion LLP says: 'ISQM 1 is just ISA 220 for the whole firm, so we only need each engagement partner to follow ISA 220.' Evaluate this statement.

Show the solution

State the position: the statement is incorrect.
Scope of ISQM 1: it requires the firm to design, implement and operate a system of quality management covering all eight components. It is about the firm's governance, resources, policies and monitoring. It also requires the firm to assign to engagement partners the responsibility for managing and achieving quality on engagements, and ISA 220 (Revised) sets out how the partner discharges it.
Scope of ISA 220 (Revised): it deals with the engagement partner's responsibility for quality on an individual audit, such as direction, supervision and review. It applies to each audit of financial statements, and the engagement partner remains responsible for managing and achieving quality on the engagement.
Relationship: the engagement team may rely on the firm's system unless the partner's understanding or other information indicates otherwise. This reliance does not remove the partner's own responsibility, and ISA 220 compliance alone cannot deliver firm-level quality.
Other gaps: ISA 220 does not require the firm to set quality objectives, carry out an annual evaluation of the system or set up a remediation process. ISQM 1 does.
Conclusion: ISA 220 is necessary but not sufficient.

Answer: The statement is wrong. ISQM 1 sets requirements for the firm's whole system, including governance, resources, acceptance, monitoring and an annual evaluation. ISQM 1 also requires the firm to assign engagement partners responsibility for managing and achieving quality on engagements. ISA 220 covers how the engagement partner discharges that role on each audit of financial statements, and the partner may rely on the firm's system unless information suggests otherwise. Orion LLP must meet both.

Exam tips

Name the level first. A one-line statement that this is a firm-level issue under ISQM 1 shows control and avoids mixing standards.
Use the component names as headings in your answer. Markers can then see your coverage quickly.
For appointment questions, always cover integrity, competence and resources, and ethics and independence before you give a decision.
Make a firm decision and justify it. Say accept, decline or accept with conditions, and name the conditions.
Tie every response to a scenario fact and, where relevant, to monitoring. Generic lists earn little in the professional skills marks.

Practice questions from Professional appointments

Quality Management at Firm Level (ISQM 1): frequently asked questions

What are the components of the system of quality management in ISQM 1?

There are eight: the risk assessment process, governance and leadership, relevant ethical requirements, acceptance and continuance of client relationships and specific engagements, engagement performance, resources, information and communication, and the monitoring and remediation process. Learn them as a set because scenarios often touch several.

What is the difference between ISQM 1 and ISA 220?

ISQM 1 applies to the firm and requires a system of quality management. ISA 220 (Revised) applies to an individual audit and sets out the engagement partner's responsibilities for quality on that audit. ISA 220 works within the firm's system under ISQM 1.

How do appointment decisions fit into ISQM 1?

They fall under acceptance and continuance. The firm should only accept or keep a client or engagement if it is competent, has the time and resources, can meet ethical requirements including independence, and has considered the client's integrity and the engagement's quality risks.

Who is responsible for the system of quality management?

The firm must assign ultimate responsibility and accountability for the system to the firm's CEO or managing partner (or equivalent) or, if appropriate, the managing board of partners. They evaluate the system at a specified point in time, then at least annually. The conclusion is one of three: reasonable assurance, reasonable assurance except for matters that are severe but not pervasive, or no reasonable assurance because deficiencies are severe and pervasive.