Advanced Audit and Assurance (International) · Quality management (firm and engagement level)

ISQM 1 Monitoring and Remediation Process Explained

Updated 11 October 2026

Under ISQM 1, a firm monitors its quality management system to check it works, evaluates any findings to decide if they are deficiencies, investigates root causes, and remediates them. The firm then evaluates the whole system at least annually and concludes whether it gives reasonable assurance that its quality objectives are met.

Understand Monitoring and Remediation of the Quality System

A quality system that is never tested cannot be trusted. Monitoring and remediation is the part of ISQM 1 that tests the system and fixes it. It is the feedback loop. The firm designs responses to quality risks, then checks whether those responses work in practice.

The firm designs monitoring activities to give relevant, reliable information about the system. These include inspecting completed engagements and reviewing the firm's own processes. The firm decides the nature, timing and extent of the activities based on its risks. It must also consider the results of external inspections and the findings of earlier monitoring.

A cold file review (or post-issuance review) looks at an engagement after the report is issued. It tests whether the work met standards, but it cannot change the report already issued. In practice, a review done before the report is issued is called a hot review. "Hot" and "cold" are practice terms, not ISQM 1 terminology. Engagement quality reviews are a separate engagement-level response under ISQM 2. They are not part of ISQM 1 monitoring. Hot reviews protect the current engagement. ISQM 1 monitoring inspects completed engagements, and that tells the firm about the system as a whole. ISQM 1 requires the firm to inspect completed engagements on a cyclical basis, with at least one completed engagement inspected for each engagement partner over the cycle. The firm sets the cycle, and the standard does not fix its length. The reviewers must be objective and not have been involved in the engagement.

When monitoring finds a problem, the firm evaluates the findings to decide if they are deficiencies. A deficiency exists where a quality objective is not established, a quality risk is not identified or assessed properly, a response is not properly designed, implemented or operating effectively, or another aspect of the system is missing or not properly designed. The firm then investigates the root causes. It asks why the problem happened, not just what happened. Root cause analysis is proportionate. A serious or repeated finding needs a deeper look than an isolated minor one.

The firm then evaluates the severity and pervasiveness of the deficiencies. Severity is about how serious the deficiency is. Pervasiveness is about how widely it affects the system as a whole, for example across several partners, offices or areas, rather than one area. The firm designs and implements remediation actions that address the root causes. It later checks that the actions worked. Finally, the individual assigned ultimate responsibility and accountability for the system evaluates the system as at a specified date, at least annually. The deficiencies that remain at that date determine the conclusion, and the leader takes into account any remediation already in place. The conclusion is one of three: the system provides reasonable assurance that its objectives are being achieved; it does so except for matters related to deficiencies that are severe but not pervasive; or it does not provide reasonable assurance because deficiencies are severe and pervasive. The firm must also communicate findings to engagement teams and other relevant people, and it must document the process.

Key rules to remember

Monitoring and remediation cycle: Monitor → evaluate findings → identify deficiencies → root cause analysis → evaluate severity and pervasiveness → remediate → evaluate the system; Use this as your answer skeleton. Each step feeds the next.
Definition of a deficiency: Deficiency = quality objective not established, OR quality risk not identified or assessed properly, OR response not properly designed, implemented or operating effectively, OR another aspect of the system missing or not properly designed; Not every finding is a deficiency. The firm must evaluate first.
Hot review vs cold review (practice terms): Hot = before report issued; Cold = after report issued; These are practice terms, not ISQM 1 terminology. Hot protects the current engagement. Cold inspects completed engagements, tests the system and cannot change the issued report. Engagement quality reviews are a separate response under ISQM 2, not ISQM 1 monitoring.
Annual evaluation of the system: Evaluation as at a specified date, at least annually → conclusion based on the deficiencies at that date: reasonable assurance / reasonable assurance except for matters related to deficiencies that are severe but not pervasive / no reasonable assurance because deficiencies are severe and pervasive; Done by the individual assigned ultimate responsibility and accountability for the system. Remediation in place at the evaluation date is taken into account when assessing the remaining deficiencies. Severe and pervasive deficiencies mean the system does not provide reasonable assurance.
Root cause scope: Depth of root cause analysis depends on the nature and severity of the finding; Isolated minor issues need less analysis. Repeated or serious issues need more.

How to solve Monitoring and Remediation of the Quality System questions

Exam questions give a scenario of a firm with inspection findings or failures. Use this method to structure a clear answer that earns technical and professional skills marks.

1Read the requirement and identify which stage of the cycle is asked: monitoring design, evaluating findings, root cause, remediation or annual evaluation.
2Pick out the facts in the scenario: what went wrong, how many engagements, which partners, and how long it has been happening.
3Decide whether the findings are deficiencies. Link each to a quality objective or response that failed.
4Suggest likely root causes by asking why. Consider workload, training, partner tone, resources, technology and supervision.
5Assess severity and pervasiveness. A single file points to a narrow issue. Several partners or offices point to a system issue.
6Propose remediation that targets each root cause, with an owner and a follow-up check. Do not offer generic advice such as 'train staff' without saying why it fits.
7Conclude on the annual evaluation: what the leader could conclude and what communication is needed to engagement teams and others.
8Finish with a short recommendation in the format asked, such as a memo, to show professional skills.

Quickest way: Finding, Cause, Fix, Check

When to use it: Use when time is short and the question gives a list of inspection findings to deal with.

Write the finding in one line.
Say which quality objective or response failed. That makes it a deficiency.
Give one or two root causes from the scenario facts.
Give a fix aimed at the cause, plus how the firm will check it worked.
Add one line on severity and its effect on the annual conclusion.

Common mistakes in Monitoring and Remediation of the Quality System

Treating every finding as a deficiency.
Students assume any error found in a file means the system failed.
Fix: Say the firm must first evaluate whether the finding shows a quality objective not met or a response not working. Then call it a deficiency.
Confusing hot and cold reviews.
Both are called reviews and both check file quality.
Fix: Anchor on timing. Hot is before the report is issued. Cold is after. State the purpose of each as well. Remember these are practice terms, not ISQM 1 terms, and engagement quality reviews fall under ISQM 2.
Stopping at the symptom in root cause analysis.
The scenario names the error, so students just restate it.
Fix: Ask why at least twice. For example, missing evidence is the symptom. Poor supervision caused by overloaded managers is the root cause.
Proposing remediation that does not match the root cause.
Students default to staff training for everything.
Fix: Link each action to a cause. Use resourcing, partner accountability, templates, technology or policy change where those fit better than training.
Ignoring the annual evaluation and its conclusion.
Students focus on file reviews and forget the final step.
Fix: Always end by saying who evaluates, when, and which of the three conclusions is likely given the severity and pervasiveness.
Using reviewers who worked on the engagement or are not objective.
Small firms have few people and students overlook independence of the reviewer.
Fix: State that inspectors must be objective and not involved in the engagement. Suggest an external reviewer or network resource for small firms.

Worked examples

Example 1

Marlow & Co is a mid-sized audit firm. Its annual cold file review found that on four of the six audit files inspected, audit documentation of going concern work was inadequate. The four files belong to three different engagement partners. Required: (a) Explain whether this is a deficiency and how severe it might be. (b) Explain how the firm should deal with it. (10 marks style)

Show the solution

Step 1: Is it a deficiency? The firm's response to the quality risk of poor documentation is not operating effectively. So the finding is a deficiency, subject to the firm's evaluation.
Step 2: Severity and pervasiveness. The finding is likely severe, because inadequate going concern documentation affects an important area of audit work and the reliability of reports. Pervasiveness depends on how widely it affects the system as a whole. Three partners are affected, which points to a problem beyond one individual. But the finding is confined to going concern work, so it may not be pervasive unless similar problems exist in other areas, offices or teams. Six files is a small sample, so the firm should extend its testing before deciding.
Step 3: Root cause analysis. The firm should ask why. Possible causes are no standard going concern working paper, rushed completion at busy times, weak review by managers or partners, or lack of understanding of ISA 570 requirements.
Step 4: Remediation. Match actions to causes. Introduce a going concern template and checklist. Require review of this area before sign-off. Give targeted guidance to the three partners. Adjust timetables if workload is the cause.
Step 5: Follow-up. Select further files, including current ones, to confirm the fix works. For current engagements, the firm should consider whether additional work is needed before reports are issued.
Step 6: Annual evaluation and communication. The leader should consider the effect on the annual conclusion. Findings and remediation should be communicated to engagement teams.

Answer: The finding is a deficiency because a response to a quality risk is not operating effectively. It is likely severe. Whether it is pervasive depends on whether it affects the system broadly or stays confined to going concern work, so the firm should extend testing to see. It should find root causes, such as no template or weak review, then apply targeted fixes, check them with follow-up reviews and reflect the result in the annual evaluation of the system.

Example 2

Kestrel LLP's quality leader is preparing the annual evaluation of the quality management system. During the year, one cold review found a missing independence confirmation for one junior staff member on one audit. The firm investigated, found it was a one-off caused by a staff member joining mid-engagement, updated its onboarding checklist and confirmed the confirmation was then obtained with no threat identified. Required: Explain what conclusion the leader is likely to reach and what they should consider.

Show the solution

Step 1: Is it a deficiency? A response, which is collecting independence confirmations, was not operating effectively for one individual. It is likely a deficiency.
Step 2: Severity. It affected one person on one engagement. No independence threat was found. So it is unlikely to be severe.
Step 3: Pervasiveness. The root cause was specific, being a mid-engagement joiner. It does not suggest a wide failure across the system, so it is unlikely to be pervasive.
Step 4: Remediation. The onboarding checklist was updated. The leader should evaluate the remediation. They should check that it was implemented, that it addresses the root cause, and that it is working, for example by testing later joiners.
Step 5: Conclusion. The evaluation is as at a specified date. The deficiency is not severe and pervasive, and there are no other severe deficiencies in the facts given. The leader is therefore likely to conclude that the system provides reasonable assurance that its objectives are being achieved. The remediation already in place supports that view.
Step 6: Other considerations. The leader should also consider results of other monitoring and any external inspection findings before concluding, and document the basis for the conclusion.

Answer: The leader is likely to conclude the system provides reasonable assurance. The deficiency was isolated, root-caused and remediated, and it is neither severe nor pervasive. The conclusion must still take account of all other monitoring and external inspection results and be documented.

Exam tips

Always anchor your answer on the stage asked. If the question says root cause, do not just list remediation.
Use scenario numbers, such as how many files or partners were affected, to judge severity and pervasiveness. This earns application marks.
Make remediation specific and tied to a cause. Add who owns it and how the firm will check it worked.
Show professional skills. Write a clear memo to the board or quality leader, challenge weak firm responses with scepticism, and give a commercial recommendation.
Know the three possible annual conclusions and be ready to pick one with a reason.

Practice questions from Quality management (firm and engagement level)

Monitoring and Remediation of the Quality System: frequently asked questions

What is the difference between a cold review and a hot review?

"Hot" and "cold" are practice terms, not ISQM 1 terminology. A hot review is done before the audit report is issued. A cold review is done after the report is issued. ISQM 1 monitoring inspects completed engagements, so it tests how the firm's system is working overall. Engagement quality reviews are a separate response under ISQM 2.

Does ISQM 1 require root cause analysis?

Yes. When the firm identifies deficiencies, it must investigate the root causes. The depth of the investigation depends on the nature and severity of the deficiency, so minor isolated issues need less than serious or repeated ones.

How often must the quality management system be evaluated?

The person with ultimate responsibility for the system must evaluate it at least annually, as at a point in time. They then conclude whether the system provides reasonable assurance that its objectives are being met.

Do all engagement partners have to be inspected?

ISQM 1 requires the firm to inspect completed engagements on a cyclical basis, with at least one completed engagement inspected for each engagement partner over the cycle. The firm sets the cycle, and the standard does not fix its length. The reviewers must be objective.