Skip to content

Advanced Audit and Assurance (International) · Quality management (firm and engagement level)

ISQM 1 Quality Management System Overview for ACCA AAA

Updated 11 October 2026 · Fact-checked

ISQM 1 requires a firm to design, implement and operate a system of quality management for audits and other assurance engagements. The firm sets quality objectives, identifies and assesses quality risks, and designs responses to them. The system has eight components, and the firm must evaluate it at least annually.

Understand ISQM 1 Quality Management System Overview

A firm's system of quality management (SoQM) is how it gives reasonable assurance that its engagements are performed in line with professional standards and that reports are appropriate. ISQM 1 applies to firms that perform audits or reviews of financial statements, or other assurance or related services engagements.

ISQM 1 is risk-based. Older ISQC 1 gave a fixed list of policies and procedures. ISQM 1 asks the firm to think about its own circumstances. The firm does three things: set quality objectives, identify and assess quality risks that could stop those objectives being achieved, and design and implement responses to address those risks. The firm tailors the system to its size, clients, services and structure.

The system has eight components:

  • The firm's risk assessment process
  • Governance and leadership
  • Relevant ethical requirements
  • Acceptance and continuance of client relationships and specific engagements
  • Engagement performance
  • Resources
  • Information and communication
  • The monitoring and remediation process

The risk assessment process and the monitoring and remediation process drive the system. The other six components hold the objectives and responses that make up the system's day-to-day operation. Together they form a cycle: assess, respond, monitor, fix.

The firm must also set specified responses that ISQM 1 requires, such as a process for handling complaints and allegations, and for deciding which engagements need an engagement quality review. Where the firm finds a deficiency, it must investigate the root cause and remediate it. Leadership is accountable: the firm assigns ultimate responsibility and accountability for the system to the individual(s) with this role, and operational responsibility for compliance and monitoring to others. The firm evaluates the system and concludes on it at a set date at least once a year.

For the exam, think of ISQM 1 as firm level and ISA 220 (Revised) as engagement level. ISQM 2 covers engagement quality reviews. A good answer links the firm's system to what the engagement partner actually does.

Key rules to remember

Risk-based process
Quality objectives → Quality risks → Responses
Firm sets objectives, identifies risks to achieving them, then designs and implements responses. Repeat as circumstances change.
Eight components
Risk assessment; Governance and leadership; Ethics; Acceptance and continuance; Engagement performance; Resources; Information and communication; Monitoring and remediation
List them in this logical grouping and tie each to the scenario.
Evaluation of the system
Evaluate at a specified date, at least annually, and conclude
The conclusion is that the system provides reasonable assurance, or that it does so except for matters identified, or that it does not.
Reasonable assurance
System gives reasonable assurance, not absolute assurance
Never say the system guarantees quality.

How to solve ISQM 1 Quality Management System Overview questions

Use this method for any question on ISQM 1, whether it asks you to explain the system, assess a firm's weaknesses or recommend improvements.

  1. 1Read the requirement and note the verb: explain, evaluate, recommend or identify.
  2. 2Identify which component or components the scenario touches. Underline facts such as a new service line, staff turnover, a rushed acceptance or a poor inspection result.
  3. 3Link each fact to a quality risk: what could go wrong with engagement quality?
  4. 4State the quality objective or ISQM 1 requirement that applies.
  5. 5Give a specific response the firm should design and implement, such as training, consultation, an engagement quality review or monitoring.
  6. 6Add the monitoring and remediation angle: how would the firm detect the problem and fix its root cause?
  7. 7Conclude with the effect on audit quality and on the firm's public interest responsibility, and show professional judgement.

Quickest way: Component-by-component scan

When to use it: Use when time is short or the scenario is long with many issues.

  1. Write the eight components down the margin in a few words each.
  2. Tick the ones the scenario touches while you read.
  3. For each ticked component, write one fact, one risk and one response.
  4. Use the response bullets as your answer plan, ordered by marks available.
  5. Finish with one sentence on monitoring and remediation.

Common mistakes in ISQM 1 Quality Management System Overview

  • Describing ISQM 1 as a list of mandatory policies, as ISQC 1 was.

    Students learned ISQC 1 and assume it works the same way.

    Fix: Say the firm sets its own objectives, identifies and assesses its own risks and designs tailored responses.

  • Listing the eight components without applying them to the scenario.

    It feels safe to recite what you remember.

    Fix: For each component named, quote a scenario fact and give a specific action the firm should take.

  • Forgetting the risk assessment and monitoring and remediation components, or treating them as minor.

    They seem abstract next to ethics or resources.

    Fix: Remember they drive the system. Show how risks are identified and how deficiencies are investigated for root cause and fixed.

  • Saying the system gives absolute assurance or guarantees quality.

    Students overstate the effect of controls.

    Fix: Use the term reasonable assurance and note that the system cannot remove all risk.

  • Confusing firm-level ISQM 1 with engagement-level ISA 220 or ISQM 2.

    All three deal with quality and are studied together.

    Fix: ISQM 1 is the firm's system, ISA 220 is the engagement team's responsibilities and ISQM 2 covers engagement quality reviews. Name the right one.

  • Giving generic recommendations like 'improve quality'.

    Students run out of time or ideas.

    Fix: Make each recommendation concrete: who does what, and how the firm will know it worked.

Worked examples

Example 1

Explain the risk-based approach of ISQM 1 and how it differs from ISQC 1. (6 marks)

Show the solution
  1. Define the approach: the firm designs, implements and operates a system of quality management using quality objectives, quality risks and responses.
  2. Step one: the firm establishes quality objectives under each component. ISQM 1 sets some required objectives and the firm may add its own.
  3. Step two: the firm identifies and assesses quality risks, meaning risks that reasonably could, individually or in combination, stop objectives being achieved. It considers its own nature and circumstances, such as client types and service lines.
  4. Step three: the firm designs and implements responses that address the assessed risks, and revises them as risks change.
  5. Difference: ISQC 1 gave a standard set of policies and procedures in defined elements. ISQM 1 is proactive and tailored, adds governance and leadership and a risk assessment process, and requires evaluation of the system at least annually.
  6. Link to quality: a tailored system focuses effort where the risk to quality is greatest.

Answer: ISQM 1 is risk-based: the firm sets quality objectives, identifies and assesses quality risks, and designs and implements responses. ISQC 1 prescribed policies by element. ISQM 1 is tailored to the firm, includes a risk assessment process and governance and leadership, and requires an annual evaluation of the system.

Example 2

Mehta & Co is a mid-sized firm. In the last year, three partners left and were replaced by staff promoted from within. Several audit files reviewed by the firm's internal inspection team had weak evidence on estimates. The firm took no action beyond reminding staff by email. Evaluate the firm's approach in the context of ISQM 1 and recommend improvements. (8 marks)

Show the solution
  1. Identify components: resources (loss of experienced partners, promoted staff), engagement performance (weak evidence on estimates), and monitoring and remediation (inspection found a deficiency but response was weak).
  2. Risk assessment: partner turnover is a quality risk because inexperienced partners may lack competence or time to supervise. The firm should have identified and assessed this risk and designed responses.
  3. Monitoring and remediation: the inspection identified a finding. ISQM 1 requires the firm to evaluate the severity and pervasiveness of deficiencies, investigate root causes and design remedial actions. An email reminder does not address root cause, such as lack of expertise on estimates.
  4. Recommend responses: provide targeted training on ISA 540 and estimates, assign more experienced reviewers or specialists to files with significant estimates, and introduce consultation requirements.
  5. Recommend for resources: partner development and coaching for newly promoted partners and a review of workloads.
  6. Recommend follow-up: monitor later files to check the actions worked, and report the matter to leadership, who are accountable for the system.
  7. Conclude: the firm's approach is reactive and weak. Without these changes the firm may not be able to conclude that its system gives reasonable assurance.

Answer: The firm has not applied ISQM 1 properly. It did not assess the risk from partner turnover and did not investigate the root cause of the inspection findings. It should provide training on estimates, add experienced review or specialist input, support new partners, monitor the effect and report to leadership, who hold ultimate accountability for the system.

Exam tips

  • Always tie the eight components to scenario facts. A bare list earns few marks.
  • Use the vocabulary: quality objectives, quality risks, responses, deficiency, root cause, reasonable assurance.
  • When a scenario shows a finding or failure, go straight to monitoring and remediation, and ask what the firm should do about the root cause.
  • Show professional skills: weigh the risk to audit quality against commercial pressure such as winning a client or keeping a deadline.
  • Keep ISQM 1 (firm), ISA 220 (engagement) and ISQM 2 (engagement quality review) separate in your answer.

Practice questions from Quality management (firm and engagement level)

ISQM 1 Quality Management System Overview: frequently asked questions

What is the difference between ISQC 1 and ISQM 1?

ISQC 1 gave a fixed set of policies and procedures for firms to follow. ISQM 1 is risk-based: the firm sets quality objectives, assesses its own quality risks and designs responses. ISQM 1 also adds governance and leadership, a risk assessment process and an annual evaluation of the system.

What are the eight components of ISQM 1?

They are the risk assessment process, governance and leadership, relevant ethical requirements, acceptance and continuance, engagement performance, resources, information and communication, and monitoring and remediation. The risk assessment and monitoring and remediation processes drive the system.

Who is responsible for the system of quality management?

The firm assigns ultimate responsibility and accountability for the system to the individual(s) with this role, usually the firm's managing partner or CEO. Operational responsibility for compliance and monitoring is assigned to others. The firm's leadership is responsible for promoting a culture of quality.

How often must a firm evaluate its system under ISQM 1?

The firm must evaluate the system at a specified date and at least annually. It then concludes whether the system gives reasonable assurance that its objectives are achieved. Deficiencies found must be investigated and remediated.