Skip to content

ACCA Strategic Professional · Advanced Audit and Assurance (International)

Quality Management at Firm and Engagement Level for ACCA AAA

Quality management is how an audit firm designs, runs and checks controls so its audits are reliable. ISQM 1 sets the firm-level system, ISQM 2 covers engagement quality reviews. To answer exam questions, spot the weakness in the scenario, link it to the right component, and recommend a specific, practical response.

What this chapter covers

This chapter covers how an audit firm manages quality. ISQM 1 requires the firm to design, implement and operate a system of quality management for audits, reviews and other assurance or related services engagements. It is risk-based. The firm sets quality objectives, identifies and assesses quality risks, and designs responses to address them. There are eight components:

  • governance and leadership
  • relevant ethical requirements
  • acceptance and continuance of client relationships and engagements
  • engagement performance
  • resources
  • information and communication
  • the firm's risk assessment process
  • the monitoring and remediation process

At engagement level, the engagement quality review (EQR) is a key response. ISQM 1 sets out when an EQR is required. The criteria apply to all engagements, and the listed-entity limb applies specifically to audits of financial statements of listed entities. An EQR is required for audits of financial statements of listed entities, for engagements where law or regulation requires one, and for engagements where the firm judges that an EQR is an appropriate response to assessed quality risks. ISQM 2 then deals with the appointment and eligibility of the reviewer, and with how the review is performed and documented. The reviewer assesses significant judgements made by the team and the conclusions reached. The chapter ends with audit quality more broadly: quality reviews, regulatory inspection and how firms respond to findings.

This chapter links to almost every other part of the paper. Acceptance and continuance connects to ethics and engagement risk. Engagement performance connects to planning, supervision, review and documentation. Significant judgements in audit evidence, going concern and group audits are what an EQR reviewer looks at. Scenario questions may present a quality failure and ask you to explain the cause and the fix.

Quality management questions may be set as scenarios in AAA, and the topic also supports the professional skills marks, because you must show scepticism, apply your points to the facts and communicate clearly. Weak answers list ISQM 1 components from memory. Strong answers identify what has gone wrong in the firm, name the relevant component, and give a specific action. That skill can be applied in many other questions, such as ethics, planning and reporting. If you learn the logic of the system rather than a list, you can earn marks in both technical and professional skills areas.

Quality management (firm and engagement level): topics in the order to study them

  1. 1ISQM 1 Quality Management System OverviewStart here. The risk-based structure and the components frame everything else in the chapter.
  2. 2Firm Governance, Leadership and Ethical RequirementsTone at the top, accountability and independence come first in the system and underpin the other components.
  3. 3Resources, Information and CommunicationStaff, technology and information flows enable the engagement-level work that follows.
  4. 4Engagement Performance and ISQM 2 Engagement Quality ReviewsThis is where firm policies reach individual audits, and it can be tested through a scenario.
  5. 5Monitoring and Remediation of the Quality SystemOnce you know the system, you learn how the firm checks it works and fixes deficiencies.
  6. 6Audit Quality, Quality Reviews and Regulatory InspectionFinish with the external view, which draws on all earlier topics and suits wider discussion questions.

How to prepare Quality management (firm and engagement level)

Treat this as a chapter about cause and response. Learn the system as a logical chain, then practise applying it to scenarios.

  1. Learn the risk-based chain: quality objectives, quality risks, responses. Be able to explain it in your own words.
  2. List the components of ISQM 1 and attach one realistic example of a weakness and a response to each.
  3. Study ISQM 2 separately. Know when an EQR is required, who may act as reviewer, and what the reviewer evaluates.
  4. Link the chapter to the rest of the paper: ethics, acceptance, planning, supervision, documentation and significant judgements.
  5. Practise scenario requirements. For each, identify the quality failure, name the component, explain the risk and give a specific recommendation.
  6. Write short answers under time pressure. Use clear points with a heading, the issue, the application and the action.
  7. Revisit monitoring and inspection findings. Practise explaining root cause analysis and how remediation should be tracked.

Common mistakes in Quality management (firm and engagement level)

  • Listing the ISQM 1 components without applying them to the scenario

    Fix: Start with the problem in the scenario. Name the component it relates to, explain the risk, then recommend an action.

  • Confusing ISQM 1 with ISQM 2

    Fix: Remember that ISQM 1 is the firm's system, including setting when an EQR is required. ISQM 2 deals with the appointment and eligibility of the reviewer and how the review is performed and documented.

  • Giving generic recommendations such as 'improve training'

    Fix: Say who should do what, how often and how you would check it worked. Tie it to the facts given.

  • Treating the EQR as a re-performance of the audit

    Fix: The reviewer evaluates significant judgements and the conclusions reached. They are objective and do not replace the team's work.

  • Ignoring root cause in monitoring and remediation answers

    Fix: Explain why the problem arose, how serious it is, what the fix is and how the firm will confirm the fix works.

  • Forgetting professional skills in the answer

    Fix: Show scepticism, make a clear recommendation and write in an organised, concise way suited to the reader, such as a partner.

Last-day revision: Quality management (firm and engagement level)

  • ISQM 1 requires a system of quality management that is risk-based, not a fixed checklist.
  • ISQM 1 applies to audits, reviews and other assurance or related services engagements.
  • The firm sets quality objectives, identifies and assesses quality risks, then designs and implements responses.
  • Governance and leadership set the culture. Leaders must be accountable for quality.
  • The firm must have policies on relevant ethical requirements, including independence, and must monitor compliance.
  • Acceptance and continuance decisions consider integrity of the client, competence, capability and resources.
  • Resources include people, technology and intellectual resources. Poor resourcing is a common quality risk.
  • Information and communication must flow both ways, within the firm and to external parties where needed.
  • Engagement performance covers direction, supervision, review, consultation and documentation.
  • ISQM 1 sets when an EQR is required. The criteria apply to all engagements: audits of financial statements of listed entities, engagements where law or regulation requires one, or engagements where the firm judges it is an appropriate response to quality risks.
  • ISQM 2 covers the appointment and eligibility of the reviewer and how the review is performed and documented. The EQR evaluates significant judgements and conclusions, and it must be completed before the engagement report is released. The engagement partner must not date the report until the EQR is complete.
  • The EQR reviewer must be objective, competent and have sufficient authority.
  • Monitoring identifies deficiencies. Remediation requires root cause analysis and follow-up.
  • Regulatory inspection findings should feed back into the firm's risk assessment and system.

Quality management (firm and engagement level) practice questions

Quality management (firm and engagement level) in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Quality management (firm and engagement level): frequently asked questions

What is the difference between ISQM 1 and ISQM 2?

ISQM 1 covers the firm's overall system of quality management, including when an engagement quality review is required. ISQM 2 covers the appointment and eligibility of the reviewer and how the review is performed and documented. A firm-wide weakness points to ISQM 1. An issue with the review of an individual engagement points to ISQM 2.

Do I need to memorise the ISQM 1 components?

Yes, you should know them, but memorising is not enough. Marks come from applying them to the facts. Learn one typical weakness and one response for each component.

How might quality management questions be set in AAA?

They may be set as scenarios where something has gone wrong in a firm or on an engagement. You may be asked to explain the issues, assess the quality risks or recommend improvements. Whatever the format, you need to know the components and apply them to the facts.

How should I use quality inspection findings in my answer?

Treat findings as evidence of a possible weakness in the system. Explain the likely root cause, which component is affected and what remediation the firm should put in place. Then say how the firm will monitor that the fix works.