Advanced Audit and Assurance (International) · Quality management (firm and engagement level)

ISQM 1 Resources, Information and Communication Explained for ACCA AAA

Updated 11 October 2026 · Fact-checked

Under ISQM 1, a firm must set quality objectives for resources (people, technology and intellectual resources) and for information and communication. It identifies quality risks, designs responses, and checks them. Good answers link a weakness to its risk and propose a specific, practical response.

Understand Resources, Information and Communication

ISQM 1 requires a firm to run a system of quality management. The system has components. Two of them work closely together: resources and information and communication. Both are examined as scenario problems, so you must apply them, not just list them.

The resources component covers what the firm needs to perform engagements well. There are three types. Human resources are partners and staff: recruiting, developing, retaining, assigning and assessing them. Technological resources are things like audit software, data analytics tools and IT systems the firm relies on. Intellectual resources are items like the firm's methodology, manuals, templates, guidance and accounting or auditing reference material. Firms may also use service providers, such as an external network firm, a specialist or an outsourced function. The firm must be satisfied that these resources are appropriate and are actually used.

On people, think of a chain. The firm hires competent people with the right capabilities. It trains them and gives them time to develop. It assigns the right people to each engagement, matching the team's competence and time to the complexity and risk of the job. It holds people accountable through appraisal and rewards that favour quality. Each engagement partner must have the competence, capabilities and time to do the job, and the firm must make sure the partner is clear about their role.

The information and communication component is about the flow of information. The firm needs information systems that capture, process and share reliable information to support the system of quality management. It must communicate internally, so that people understand their responsibilities and the firm's expectations on quality. It must also communicate externally, for example with network firms, service providers, those charged with governance and regulators, when required. Communication must be timely, clear and two-way, so staff can raise concerns without fear.

In the exam, the pattern is simple. The scenario shows a failure, such as an unqualified partner on a listed client, a tool no one is trained on, or a staff concern ignored. You name the quality objective affected, explain the risk to audit quality, and recommend a specific response.

Key rules to remember

Resources component: three types: Resources = human + technological + intellectual (plus service providers where used); Use these headings to structure any answer on resources. Add service providers when the scenario mentions outsourcing or a network.
Human resources cycle: Recruit → Develop → Retain → Assign → Assess and hold accountable; Covers competence, capabilities and time. Match each engagement team to the complexity and risk of the engagement.
Engagement partner requirement: Partner needs competence + capabilities + sufficient time + clear role; Missing any one element is a quality risk, for example a partner who is overloaded with too many engagements.
Information and communication flows: Information system + internal communication + external communication; Communication should be timely and two-way. External parties include network firms, service providers, those charged with governance and regulators.
Quality risk response: Objective → Quality risk → Response; This is the logic behind ISQM 1. Write each answer point in this order for full marks.

How to solve Resources, Information and Communication questions

Use this method for any scenario question on resources, information or communication. It keeps your answer structured and tied to the facts.

1Read the requirement. Note whether you must identify weaknesses, assess risks, recommend responses or all three.
2Mark each fact in the scenario that points to a resource or communication problem. Label each as human, technological, intellectual, service provider, information or communication.
3For each problem, state the affected quality objective in a short phrase, such as appropriate people being assigned to engagements.
4Explain the quality risk: what could go wrong with the audit and why the opinion could be unreliable.
5Recommend a specific response the firm could implement, such as training, a staffing review, a system access control or a reporting channel for concerns.
6Link the response to the scenario: name the partner, client, tool or team, and use the numbers given.
7Add a professional skills point where asked, such as a measured judgement, a priority order or a clear recommendation.
8Check that each point has a problem, a risk and a response. Trim any generic text.

Quickest way: Problem – risk – response in three lines

When to use it: Use this when time is short or the requirement asks for brief points. It works well for 4 to 8 mark parts.

Sort scenario facts into people, technology, intellectual resources, or information and communication.
For each fact, write one line: the problem, then one line for the risk to audit quality.
Finish with one concrete response. Use a verb such as train, reassign, restrict, update or escalate.
Stop when you have one point per mark. Do not repeat the ISQM 1 text.

Common mistakes in Resources, Information and Communication

Listing every ISQM 1 resource heading without using the scenario.
Students memorise the standard and write it out, hoping to catch marks.
Fix: Pick only the facts shown in the scenario. Name the issue, the risk and the response for each.
Talking only about people and forgetting technological and intellectual resources.
Resources sounds like staff, so other types are overlooked.
Fix: Scan the scenario for software, data tools, methodology or manuals. Cover each type that appears.
Saying the engagement team should simply be 'competent'.
It is a safe, short phrase that needs no thought.
Fix: Specify what the team lacks, such as sector knowledge or experience with a complex tool, and how to close the gap through training, a specialist or reassignment.
Ignoring time and workload when assessing a partner or team.
Students focus on qualifications and overlook capacity.
Fix: Check whether the partner or team has enough time. Overloaded people are a quality risk even if they are skilled.
Treating communication as one-way, from the firm to staff.
Policies are seen as top-down instructions.
Fix: Mention channels for staff to raise concerns, how the firm acts on them, and communication with network firms, service providers and those charged with governance.
Recommending a response that does not fix the stated risk.
Students give a standard answer such as more training, regardless of the cause.
Fix: Match the response to the cause. A tool access problem needs system controls. A staffing mismatch needs reassignment.

Worked examples

Example 1

Harbour & Co is a mid-sized audit firm. It has accepted the audit of a listed bank, a new sector for the firm. The engagement partner has only audited small manufacturing companies and already leads eleven other engagements. The team uses a new data analytics tool, but only two of the six team members have been trained on it. Identify the quality issues under the resources component and recommend responses. (8 marks)

Show the solution

Issue 1, human resources: the partner has no sector experience. The risk is that complex bank risks, such as loan impairment, are not identified or challenged. Response: assign a partner or senior manager with banking experience, or add a specialist as an expert, and give the current partner sector training.
Issue 2, human resources: the partner leads eleven other engagements. The risk is insufficient time for direction and review on a high-risk listed client. Response: review the partner's workload and reduce other commitments, or appoint a co-partner for the bank.
Issue 3, technological resources: only two of six team members are trained on the analytics tool. The risk is that the tool is misused or its outputs are misunderstood, so evidence may be unreliable. Response: provide training before fieldwork starts and have trained staff supervise untrained members.
Issue 4, assignment: the team as a whole may lack bank experience. Response: reassess team composition against the engagement's complexity and consider assigning at least one experienced bank auditor.
Conclude: the firm should confirm these responses before the engagement continues, as the risk for a listed bank is high.

Answer: The main issues are the partner's lack of sector competence and capacity, and untrained use of the analytics tool. Responses include assigning a suitably experienced partner or specialist, reducing the partner's workload, training the team before fieldwork, and reviewing the team's composition.

Example 2

At Delta LLP, a junior auditor noticed that a client's inventory records on the firm's shared drive had been overwritten by a colleague. She told her manager, but heard nothing back. Separately, the firm's updated audit manual was emailed to staff, but no one confirmed reading it. Explain the weaknesses in information and communication and recommend improvements. (6 marks)

Show the solution

Weakness 1: the concern was raised but the firm did not respond. The risk is that staff stop speaking up and data integrity issues go unfixed, which could affect audit evidence. Response: set up a formal channel for raising concerns, with a named person responsible, a response time and feedback to the person who raised it.
Weakness 2: the shared drive allowed records to be overwritten. This is an information system weakness. The risk is that audit documentation is lost or altered. Response: restrict edit rights, keep version history and back up the files.
Weakness 3: the manual was emailed without confirmation. The risk is that staff apply outdated procedures and the firm cannot show they understood the update. Response: require acknowledgement, brief staff in a short session and keep a record of who has confirmed.
Link back to quality: communication must be timely, clear and reach the people who need it, and the firm should check that it works.

Answer: Delta LLP has no effective route for raising concerns, weak controls over its information system, and no check that policy updates are received. It should create a responsive concerns channel, restrict and back up shared files, and require acknowledgement and briefing for manual updates.

Exam tips

Always tie each point to a fact in the scenario. Generic ISQM 1 text earns few marks.
Use the three resource headings (human, technological, intellectual) as a checklist, then add service providers if mentioned.
For any partner or team issue, test competence, capabilities and time separately.
Give a response that fixes the stated cause, and state the risk to audit quality in the same sentence.
Where professional skills marks are available, prioritise the most serious issue first and give a clear recommendation.

Practice questions from Quality management (firm and engagement level)

Resources, Information and Communication: frequently asked questions

What are the three types of resources in ISQM 1?

They are human resources, technological resources and intellectual resources. Human resources are people. Technological resources are IT and tools, and intellectual resources are methodology, manuals and guidance. Firms may also use service providers.

How does ISQM 1 deal with engagement partner competence?

The firm must assign engagement partners who have the competence, capabilities and time to perform the engagement. The partner must also understand their role and responsibilities. A lack of sector knowledge or too many engagements is a quality risk.

What does the information and communication component require?

The firm needs an information system that supports the quality management system. It must also communicate internally and externally in a timely way. This includes people raising concerns and the firm sharing information with network firms, service providers and others as needed.

How do I answer a scenario question on this topic?

Spot the facts that show a weakness, name the quality risk and recommend a specific response. Keep each point linked to the scenario. A short problem, risk and response structure works well.