The International Accounting Standards Board (IAASB) initiated a campaign in 2004 to improve the clarity (readability) of the ISAs.
This Clarity Project’s overarching objective was to make the ISAs more understandable, which would, in turn, make it easier to apply the standards consistently and lead to an improvement in the overall audit quality on a global scale.
After a string of corporate scandals that received widespread media attention and a widespread erosion of trust within the auditing profession, this was a vital task to carry out.
As a result of the Clarity Project, each standard now possesses a transparent structure with clear objectives, definitions, and requirements, in addition to the application and other explanatory material that provides a deeper dive into the requirements of the ISAs.
Because of how the new standards are organised, it is much simpler to comprehend what is needed and what is considered recommendations.
In addition, ISQC 1 Quality Control for Firms that Perform Audits and Reviews of Financial Statements, and Other Assurance and Related Services Engagements has been rewritten, and the revised guidance on quality control procedures went into effect at the same time as the clarified ISAs did.
These updates were made in conjunction with the International Standards on Auditing. The following constitutes the structure of each standard:
Introduction
Objective
Definitions
Requirements
Application and Other Explanatory Material
Introduction
This paragraph contains information concerning the standard, including the ISA’s purpose, scope and subject matter. It also contains information regarding the responsibilities of the auditor and others in the context in which the ISA is set.
Objective
Each ISA contains a statement of the auditor’s objective in the audit area in which the ISA is set.
Definitions
The Clarity Project included adding an element for a greater understanding of the ISAs, and as such applicable terms contained within the ISAs have now been defined.
Requirements
Clearly stated requirements support each ISA.
Phrases such as ‘the auditor should …’ have now been replaced by ‘the auditor shall …’.
The profession welcomed this improvement because it cleared any ambiguity.
The word ‘shall’ indicates that the standard expects the auditor to do something rather than ‘should’, which implies that the standard ‘may’ expect something of the auditor in certain circumstances.
Application and other explanatory material
Each ISA clearly explains more precisely what the auditor is required to do to achieve the objective of the ISA in question.
Where applicable, the ISA may also contain illustrative examples of procedures that may apply in certain circumstances.
Other explanatory material may be contained within an ISA to help the auditor understand the ISA’s overall objective and application.
The impact of the Clarity Project contributed significantly to the enhancement and uniformity of audit quality worldwide.
The IAASB set out to undertake the project to encourage international convergence and assist audit firms that operate internationally by harmonising auditing standards.
In summary, the Clarity Project had the following effect on the ISAs and ISQC:
19 ISAs and ISQC 1 were redrafted.
16 ISAs were revised and redrafted to reflect the new clarity convention.
One new standard was issued:
relating to communication, ISA 265 Communicating Deficiencies in Internal Control to Those Charged with Governance and Management
ISA 540 Audit of Accounting Estimatesand ISA 545 Auditing Fair Value Measurements and Disclosureswere combined in ISA 540 Auditing Accounting Estimates, Including Fair Value Accounting Estimates, and Related Disclosures
The Clarity Project brought about some significant changes in the work that auditors are required to undertake, which can be seen in the following summaries.
Our website's articles, templates, and material are solely for reference. Although we make every effort to keep the information up to date and accurate, we make no representations or warranties of any kind, either express or implied, regarding the website or the information, articles, templates, or related graphics that are contained on the website in terms of its completeness, accuracy, reliability, suitability, or availability. Therefore, any reliance on such information is strictly at your own risk.
Keep in touch with us so that you can receive timely updates |
The International Standard on Quality Management 1 (ISQM 1) – Quality Management for Firms that Perform Audits or Reviews of Financial Statements, or Other Assurance or Related Services Engagements strengthens firms’ quality management systems by taking a robust, proactive, and effective approach to quality management.
The standard encourages firms to design a system of quality management that is adapted to the specific nature of the firm as well as the engagements that it undertakes.
ISQM 1 replaces the standard ISQC 1, Quality Control for Firms that Perform Audits and Reviews of Financial Statements and Other Assurance and Related Services Engagements.
Who needs to meet ISQM standards?
It applies to all firms that perform audits or reviews of financial statements or other assurance or related services engagements (i.e., if the firm performs any of these engagements, ISQM 1 applies to manage quality for those engagements).
ISQM 1 allows audit firms to review their existing quality control systems to determine the relevant risks that impact audit quality and devise and put into practice procedures that are most effective at addressing those risks.
Firms are required to have their system of quality management designed and implemented by December 15, 2022.
How?
ISQM 1 addresses, among other matters:
The firm demonstrating a commitment to quality through its culture which exists throughout the firm – includes recognizing and reinforcing:
The firm’s role in serving the public interest by consistently performing quality engagements
The importance of quality in the firm’s strategic decisions and actions, including those related to the firm’s financial and operational priorities
The roles, responsibilities and accountability of leadership, leadership’s qualifications, and undertaking performance evaluations of leadership annually
Components of ISQM 1
A quality management system should function in a way that is continuous and iterative, and it should be responsive to changes in the nature of the firm as well as the circumstances in which it is engaged.
In addition to this, its operations are not conducted in a linear way.
Nevertheless, for the purposes of ISQM 1, a system of quality management addresses the eight components as follows:
The firm’s risk assessment process
Governance and leadership
Relevant ethical requirements
Acceptance and continuance of client relationships and specific engagements
Engagement performance
Resources
Information and communication
The monitoring and remediation process
System of Quality Management (SOQM)
The SOQM is the mechanism that creates an environment that enables and supports engagement teams in performing quality engagements. It helps the firm achieve consistent engagement quality because it focuses on how the firm manages the quality of engagements performed.
Similar to any system of internal control, the SOQM needs to have a purpose. The purpose is important for designing the SOQM and determining whether the SOQM is effective (i.e., whether it achieved its purpose).
Therefore, paragraph 14 of ISQM 1 includes both the objective of the firm and the objective of the SOQM.
The objective of a Firm [paragraph 14 of ISQM 1]
Paragraph 14 of ISQM 1 includes the firm’s objective in managing quality, which is to design, implement and operate a SOQM. Similar to any system of internal control, the SOQM needs to have a purpose. The purpose is important for designing the SOQM and determining whether the SOQM is effective (i.e., whether it achieved its purpose).
The objective of the SOQM [paragraph 14 of ISQM 1]
is to provide the firm with reasonable assurance that:
The firm and its personnel fulfil their responsibilities in accordance with professional standards and applicable legal and regulatory requirements, conduct engagements in accordance with such standards and requirements; and
Engagement reports issued by the firm or engagement partners are appropriate.
Hence, the objective of the SOQM is explicitly used in the requirements of ISQM 1 as follows:
The firm uses it to determine whether additional quality objectives need to be established (paragraph 24 of ISQM 1).
It is used to conclude whether the SOQM provides the firm with reasonable assurance that its objectives of the SOQM have been achieved (paragraph 54 of ISQM 1).
In a forthcoming post, we will delve more into these standards and their implications on audit firms.
ISQM 1 explains that reasonable assurance is not an absolute level of assurance because there are inherent limitations of a SOQM. Such limitations include the fact that human judgment in decision-making can be faulty and that breakdowns in the SOQM may occur, for example, due to human error, behaviour, or failures in information technology (IT) applications.
Our website's articles, templates, and material are solely for you to look over. Although we make every effort to keep the information up to date and accurate, we make no representations or warranties of any kind, either express or implied, regarding the website or the information, articles, templates, or related graphics that are contained on the website in terms of its completeness, accuracy, reliability, suitability, or availability. Therefore, any reliance on such information is strictly at your own risk.
Keep in touch with us so that you can receive timely updates |
When I was younger (wow, this makes me feel so old), audit quality was not really a “thing.” I watched my superiors perform audits they believed to be sufficient, and my colleagues and I were taught to follow in their footsteps.
We conducted what we believed to be good audits but were never informed that we would be subjected to a review by a firm or an external third party.
The Enron scandal drew attention to accounting and corporate fraud as its shareholders lost $74 billion in the four years leading up to its bankruptcy, and its employees lost billions in pension benefits.
Sarbanes-Oxley Act of 2002 (SOX)
The Sarbanes-Oxley Act of 2002 is a federal law in the US that established sweeping auditing and financial regulations for public companies. Lawmakers created the legislation to help protect shareholders, employees and the public from accounting errors and fraudulent financial practices.
This was done in response to the widespread perception that audits had been conducted improperly in the United States.
With the passage of the Sarbanes-Oxley Act of 2002 (SOX), which also established the Public Company Accounting Oversight Board (PCAOB) to oversee the audits of public companies, the requirement that audits be inspected by a government regulator was established.
Since then, regulators with comparable responsibilities have been established in a total of 54 different jurisdictions across the globe. This is shown by the fact that these jurisdictions have joined the International Forum of Independent Audit Regulators (IFIAR – https://www.ifiar.org/)
For instance, the Financial Reporting Council in the United Kingdom took on this task in 2003, the Australian Securities and Investments Commission in 2004, and the Audit Oversight Board (AOB) of the Securities Commission Malaysia in 2010.
Practice Review Committee under the Malaysian Institute of Accountants
However, the Malaysian Institute of Accountants’ Practice Review Committee conducted its inaugural meeting after Council approved the By-Laws on Practice Review in December 2002 and field review under the Practice Review Programme commenced in 2004.
Adoption of ISQC 1
In 2004, the International Auditing and Assurance Standards Board (IAASB), working under the direction of the International Federation of Accountants (IFAC), gave its approval to the ISQC 1 standard [Firm Level Quality Control – https://www.ccs-co.com/post/isqc-1-firm-level-quality-control], which addresses quality control for firms that perform audits and reviews of historical financial information and other assurance and related services engagements.
In order to fulfil the requirements established by IFAC, the Malaysian Institute of Accountants (MIA) has mandated that all registered accountants and auditors (practitioners) in the country must conform with ISQC 1 by the end of June 2006. The standards introduce several new concepts and requirements in respect of quality control within auditing firms. As a consequence of this, auditing firms are having extra responsibilities to fulfil in regard to the implementation of new quality control safeguards and procedures.
ISQC 1 is not the same as ISA 220 “Quality Control for Audits of Historical Financial Information” which sets out the quality control standards to be applied to individual audit engagements. On the other hand, the ISQC 1 focuses on firms and the people that work within them to ensure compliance with various professional standards, regulatory, and legal requirements.
A study was then carried out in 2007 by the Malaysian Institute of Accountants (MIA) and the Universiti Teknologi MARA (UiTM) suggests that the application of ISQC 1 in Malaysian small and medium audit firms is fairly restricted. The majority of small and medium-sized audit firms follow non-standard operating procedures in their day-to-day work, which fundamentally does not reflect full compliance with ISQC 1.
Understanding the International Standards on Quality Control 1
Auditing firms are required by the standards to document the proof that each of the seven components of their quality control system is functioning properly and to keep this documentation for the appropriate amount of time.
Moving Forward
Enhancing the quality should also be a primary focus during this advantageous moment.
On the basis of the most recent results of the Practice Review, which are depicted in the statistics contained within this report, practitioners are strongly encouraged to ensure that their firms comply with all of the necessary requirements, whether it be at the level of the entire firm or at the level of each individual engagement.
The audit firms NOT ONLY need to get familiar with and comprehend the important sections of the International Standard on Auditing (ISA), the International Standard on Quality Control 1 (ISQC 1), the Companies Act 2016 (CA 2016), the MIA By-Laws, and any other applicable professional standards and laws, in addition, the audit firms also need to begin making preparations well in advance to comply with newly implemented standards, notably ISQM 1 and 2.
ISQM 1 & ISQM 2
ISQM 1 & ISQM 2 will be effective from 15 December 2022.
The firm shall establish policies and procedures requiring appropriate documentation to provide evidence of the operation of each element of its system of quality control. (Ref: Para. A73–A75)
The firm shall establish policies and procedures that require retention of documentation for a period of time sufficient to permit those performing monitoring procedures to evaluate the firm’s compliance with its system of quality control, or for a longer period if required by law or regulation.
The firm shall establish policies and procedures requiring documentation of complaints and allegations and the responses to them.
会计师事务所应当制定政策和程序,要求记录投诉和指控及其处理情况。
Documentation of the System of Quality Control (Ref: Para. 57)
对质量控制制度的记录(参见:第 57 段)
Para A73
The form and content of documentation evidencing the operation of each of the elements of the system of quality control is a matter of judgment and depends on a number of factors, including the following:
The size of the firm and the number of offices.
The nature and complexity of the firm’s practice and organization. For example, large firms may use electronic databases to document matters such as independence confirmations, performance evaluations and the results of monitoring inspections.
Appropriate documentation relating to monitoring includes, for example:
Monitoring procedures, including the procedure for selecting completed engagements to be inspected.
A record of the evaluation of:
Adherence to professional standards and applicable legal and regulatory requirements;
Whether the system of quality control has been appropriately designed and effectively implemented; and
Whether the firm’s quality control policies and procedures have been appropriately applied so that reports that are issued by the firm or engagement partners are appropriate in the circumstances.
Identification of the deficiencies noted, an evaluation of their effect, and the basis for determining whether and what further action is necessary.
Consistency in the Quality of Engagement Performance (Ref: Para. 32(a))
业务执行质量的一致性(参见:第 32 段第(a)项)
Para A32
The firm promotes consistency in the quality of engagement performance through its policies and procedures.
This is often accomplished through written or electronic manuals, software tools or other forms of standardized documentation, and industry or subject matter-specific guidance materials.
Matters addressed may include:
How engagement teams are briefed on the engagement to obtain an understanding of the objectives of their work.
Processes for complying with applicable engagement standards.
Processes of engagement supervision, staff training and coaching.
Methods of reviewing the work performed, the significant judgments made and the form of the report being issued.
Appropriate documentation of the work performed and of the timing and extent of the review.
Processes to keep all policies and procedures current.
Appropriate teamwork and training assist less experienced members of the engagement team in clearly understanding the objectives of the assigned work.
适当的团队工作和培训有助于经验较少的项目组成员清楚了解所分派工作的目标。
Supervision (Ref: Para. 32(b))
监督(参见:第 32 段第(b)项)
Para A34
Engagement supervision includes the following:
Tracking the progress of the engagement;
Considering the competence and capabilities of individual members of the engagement team, whether they have sufficient time to carry out their work, whether they understand their instructions and whether the work is being carried out in accordance with the planned approach to the engagement;
Addressing significant matters arising during the engagement, considering their significance and modifying the planned approach appropriately; and
Identifying matters for consultation or consideration by more experienced engagement team members during the engagement.
The work has been performed in accordance with professional standards and applicable legal and regulatory requirements;
Significant matters have been raised for further consideration;
Appropriate consultations have taken place and the resulting conclusions have been documented and implemented;
There is a need to revise the nature, timing and extent of work performed;
The work performed supports the conclusions reached and is appropriately documented;
The evidence obtained is sufficient and appropriate to support the report, and
The objectives of the engagement procedures have been achieved.
覆核包括考虑下列问题:
是否已按照职业准则和适用的法律法规的规定执行工作;
重大事项是否已提请进一步考虑;
是否已进行适当咨询,是否已记录和执行咨询得出的结论;
是否需要修改已执行工作的性质、时间安排和范围;
已执行的工作是否支持得出的结论,并得以适当记录;
获取的证据是否充分、适当,以支持报告;
业务程序的目标是否已实现。
Consultation (Ref: Para. 34)
咨询(参见:第 34 段)
Para A36
Consultation includes discussion at the appropriate professional level, with individuals within or outside the firm who have specialized expertise.
咨询包括与会计师事务所内部或外部具有专门技能的人员,在适当专业层次上进行的讨论。
Para A37
Consultation uses appropriate research resources as well as the collective experience and technical expertise of the firm.
Consultation helps to promote quality and improves the application of professional judgment.
Appropriate recognition of consultation in the firm’s policies and procedures helps to promote a culture in which consultation is recognized as a strength and encourages personnel to consult on difficult or contentious matters.
Effective consultation on significant technical, ethical and other matters within the firm or, where applicable, outside the firm, can be achieved when those consulted:
Are given all the relevant facts that will enable them to provide informed advice; and
Have appropriate knowledge, seniority and experience, and when conclusions resulting from consultations are appropriately documented and implemented.
Documentation of consultations with other professionals that involve difficult or contentious matters that is sufficiently complete and detailed contributes to an understanding of:
The issue on which consultation was sought; and
The results of the consultation, including any decisions taken, the basis for those decisions and how they were implemented.
就疑难问题或争议事项向其他专业人士咨询所形成的足够完整和详细的记录,有助于了解:
寻求咨询的事项;
咨询的结果,包括作出的决策、决策依据以及决策的执行情况。
Considerations Specific to Smaller Firms
对小型会计师事务所的特殊考虑
Para A40
A firm needing to consult externally, for example, a firm without appropriate internal resources, may take advantage of advisory services provided by:
Other firms;
Professional and regulatory bodies; or
Commercial organizations that provide relevant quality control services.
Before contracting for such services, consideration of the competence and capabilities of the external provider helps the firm to determine whether the external provider is suitably qualified for that purpose.
Criteria for an Engagement Quality Control Review (Ref: Para. 35(b))
项目质量控制覆核的标准(参见:第 35 段第(b)项)
Para A41
Criteria for determining which engagements, other than audits of financial statements of listed entities, are to be subject to an engagement quality control review may include, for example:
The nature of the engagement, including the extent to which it involves a matter of public interest.
The identification of unusual circumstances or risks in an engagement or class of engagements.
Whether laws or regulations require an engagement quality control review. Nature,
Timing and Extent of the Engagement Quality Control Review (Ref: Para. 36– 37)
项目质量控制覆核的性质、时间和范围(参见:第 36-37 段)
Para A42
The engagement report is not dated until the completion of the engagement quality control review. However, documentation of the engagement quality control review may be completed after the date of the report.
Conducting the engagement quality control review in a timely manner at appropriate stages during the engagement allows significant matters to be promptly resolved to the engagement quality control reviewer’s satisfaction on or before the date of the report.
The extent of the engagement quality control review may depend, among other things, on the complexity of the engagement, whether the entity is a listed entity and the risk that the report might not be appropriate in the circumstances.
The performance of an engagement quality control review does not reduce the responsibilities of the engagement partner.
项目质量控制覆核的范围可能取决于业务的复杂程度、客户是否为上市实体以及出具不恰当报告的风险等因素。
实施项目质量控制覆核并不减轻项目合伙人的责任。
Engagement Quality Control Review of a Listed Entity (Ref: Para. 38)
上市实体财务报表审计的项目质量控制覆核(参见:第 38 段)
Para A45
Other matters relevant to evaluating the significant judgments made by the engagement team that may be considered in an engagement quality control review of an audit of financial statements of a listed entity include:
Significant Risks were identified during the engagement and the responses o those risks.
Judgments were made, particularly with respect to materiality and significant risks.
The significance and disposition of corrected and uncorrected misstatements identified during the engagement.
The matters are to be communicated to management and those charged with governance and, where applicable, other parties such as regulatory bodies. These other matters, depending on the circumstances, may also be applicable for engagement quality control reviews for audits of the financial statements of other entities as well as reviews of financial statements and other assurance and related services engagements.
Considerations specific to public sector audit organizations
对公共部门实体审计机构的特殊考虑
Para A46
Although not referred to as listed entities, as described in paragraph A16, certain public sector entities may be of sufficient significance to warrant the performance of an engagement quality control review.
Criteria for the Eligibility of Engagement Quality Control Reviewers
项目质量控制覆核人员的资格标准
Sufficient and Appropriate Technical Expertise, Experience and Authority (Ref: Para. 39(a))
充分、适当的技术专长、经验和权限(参见:第 39 段第(a)项)
Para A47
What constitutes sufficient and appropriate technical expertise, experience and authority depend on the circumstances of the engagement.
For example, the engagement quality control reviewer for an audit of the financial statements of a listed entity is likely to be an individual with sufficient and appropriate experience and authority to act as an audit engagement partner on audits of financial statements of listed entities.
Consultation with the Engagement Quality Control Reviewer (Ref: Para. 39(b))
向项目质量控制覆核人员咨询(参见:第 39 段第(b)项)
Para A48
The engagement partner may consult the engagement quality control reviewer during the engagement, for example, to establish that a judgment made by the engagement partner will be acceptable to the engagement quality control reviewer.
Such consultation avoids the identification of differences of opinion at a late stage of the engagement and need not compromise the engagement quality control reviewer’s eligibility to perform the role.
Where the nature and extent of the consultations become significant the reviewer’s objectivity may be compromised unless care is taken by both the engagement team and the reviewer to maintain the reviewer’s objectivity.
Where this is not possible, another individual within the firm or a suitably qualified external person may be appointed to take on the role of either the engagement quality control reviewer or the person to be consulted on the engagement.
The objectivity of the Engagement Quality Control Reviewer (Ref: Para. 40)
项目质量控制覆核人员的客观性(参见:第 40 段)
Para A49
The firm is required to establish policies and procedures designed to maintain the objectivity of the engagement quality control reviewer.
Accordingly, such policies and procedures provide that the engagement quality control reviewer:
Where practicable, is not selected by the engagement partner;
Does not otherwise participate in the engagement during the period of review;
Does not make decisions for the engagement team; and
Is not subject to other considerations that would threaten the reviewer’s objectivity.
会计师事务所需要制定政策和程序,以保持项目质量控制覆核人员的客观性。
因此,这些政策和程序要求项目质量控制覆核人员符合下列规定:
如果可行,不由项目合伙人挑选;
在覆核期间不以其他方式参与业务;
不代替项目组进行决策;
不存在可能损害覆核人员客观性的其他情形。
Considerations specific to smaller firms
对小型会计师事务所的特殊考虑
Para A50
It may not be practicable, in the case of firms with few partners, for the engagement partner not to be involved in selecting the engagement quality control reviewer.
Suitably qualified external persons may be contracted where sole practitioners or small firms identify engagements requiring engagement quality control reviews.
Alternatively, some sole practitioners or small firms may wish to use other firms to facilitate engagement quality control reviews.
Where the firm contracts suitably qualified external persons, the requirements in paragraphs 39–41 and guidance in paragraphs A47–A48 apply.
Considerations specific to public sector audit organizations
对公共部门实体审计机构的特殊考虑
Para A51
In the public sector, a statutorily appointed auditor (for example, an Auditor General, or other suitably qualified person appointed on behalf of the Auditor General) may act in a role equivalent to that of an engagement partner with overall responsibility for public sector audits.
In such circumstances, where applicable, the selection of the engagement quality control reviewer includes consideration of the need for independence from the audited entity and the ability of the engagement quality control reviewer to provide an objective evaluation.
Effective procedures encourage the identification of differences of opinion at an early stage, provide clear guidelines as to the successive steps to be taken thereafter, and require documentation regarding the resolution of the differences and the implementation of the conclusions reached.
Procedures to resolve such differences may include consulting with another practitioner or firm, or a professional or regulatory body.
解决意见分歧的程序可能包括向其他从业人员、会计师事务所、职业团体或监管机构进行咨询。
Engagement Documentation
业务工作底稿
Completion of the Assembly of Final Engagement Files (Ref: Para. 45)
完成最终业务档案的归整工作(参见:第 45 段)
Para A54
Law or regulation may prescribe the time limits by which the assembly of final engagement files for specific types of engagement is to be completed.
Where no such time limits are prescribed in law or regulation, paragraph 45 requires the firm to establish time limits that reflect the need to complete the assembly of final engagement files on a timely basis.
In the case of an audit, for example, such a time limit would ordinarily not be more than 60 days after the date of the auditor’s report.
Where two or more different reports are issued in respect of the same subject matter information of an entity, the firm’s policies and procedures relating to time limits for the assembly of final engagement files address each report as if it were for a separate engagement.
This may, for example, be the case when the firm issues an auditor’s report on a component’s financial information for group consolidation purposes and, at a subsequent date, an auditor’s report on the same financial information for statutory purposes.
Confidentiality, Safe Custody, Integrity, Accessibility and Retrievability of Engagement Documentation (Ref: Para. 46)
业务工作底稿的保密、安全保管、完整性及使用和检索(参见:第 46 段)
Para A56
Relevant ethical requirements establish an obligation for the firm’s personnel to observe at all times the confidentiality of information contained in engagement documentation unless specific client authority has been given to disclose information, or there is a legal or professional duty to do so. Specific laws or regulations may impose additional obligations on the firm’s personnel to maintain client confidentiality, particularly where data of a personal nature are concerned
Whether engagement documentation is in paper, electronic or other media, the integrity, accessibility or retrievability of the underlying data may be compromised if the documentation could be altered, added to or deleted without the firm’s knowledge, or if it could be permanently lost or damaged.
Accordingly, controls that the firm designs and implements to avoid unauthorized alteration or loss of engagement documentation may include those that:
Enable the determination of when and by whom engagement documentation was created, changed or reviewed;
Protect the integrity of the information at all stages of the engagement, especially when the information is shared within the engagement team or transmitted to other parties via the Internet;
Prevent unauthorized changes to the engagement documentation; and
Allow access to the engagement documentation by the engagement team and other authorized parties as necessary to properly discharge their responsibilities.
Controls that the firm designs and implements to maintain the confidentiality, safe custody, integrity, accessibility and retrievability of engagement documentation may include the following:
The use of a password among engagement team members to restrict access to electronic engagement documentation to authorized users.
Appropriate backup routines for electronic engagement documentation at appropriate stages during the engagement.
Procedures for properly distributing engagement documentation to the team members at the start of the engagement, processing it during the engagement, and collating it at the end of engagement.
Procedures for restricting access to, and enabling proper distribution and confidential storage of, hardcopy engagement documentation.
For practical reasons, original paper documentation may be electronically scanned for inclusion in engagement files.
In such cases, the firm’s procedures designed to maintain the integrity, accessibility, and retrievability of the documentation may include requiring the engagement teams to:
Generate scanned copies that reflect the entire content of the original paper documentation, including manual signatures, cross-references and annotations;
Integrate the scanned copies into the engagement files, including indexing and signing off on the scanned copies as necessary; and
Enable the scanned copies to be retrieved and printed as necessary. There may be legal, regulatory or other reasons for a firm to retain original paper documentation that has been scanned.
Retention of Engagement Documentation (Ref: Para. 47)
业务工作底稿的保存(参见:第 47 段)
Para A60
The needs of the firm for retention of engagement documentation, and the period of such retention, will vary with the nature of the engagement and the firm’s circumstances, for example, whether the engagement documentation is needed to provide a record of matters of continuing significance to future engagements.
The retention period may also depend on other factors, such as whether local law or regulation prescribes specific retention periods for certain types of engagements, or whether there are generally accepted retention periods in the jurisdiction in the absence of specific legal or regulatory requirements.
In the specific case of audit engagements, the retention period would ordinarily be no shorter than five years from the date of the auditor’s report, or, if later, the date of the group auditor’s report.
Procedures that the firm adopts for retention of engagement documentation include those that enable the requirements of paragraph 47 to be met during the retention period, for example to:
Enable the retrieval of, and access to, the engagement documentation during the retention period, particularly in the case of electronic documentation since the underlying technology may be upgraded or changed over time;
Provide, where necessary, a record of changes made to engagement documentation after the engagement files have been completed; and
Enable authorized external parties to access and review specific engagement documentation for quality control or other purposes.
会计师事务所用以保存业务工作底稿的程序,包括能够在保存期内能够满足第 47 段要求的程序,例如:
在保存期内便于检索和接触业务工作底稿,尤其是电子工作底稿,因为相关技术可能随着时间而升级或改变;
必要时,在完成归档工作后,提供业务工作底稿变更记录;
经过授权的外部人员为了质量控制或其他目的,接触和覆核特定业务工作底稿。
Ownership of engagement documentation
业务工作底稿的所有权
Para A63
Unless otherwise specified by law or regulation, engagement documentation is the property of the firm.
The firm may, at its discretion, make portions of, or extracts from, engagement documentation available to clients, provided such disclosure does not undermine the validity of the work performed, or, in the case of assurance engagements, the independence of the firm or its personnel.
The firm shall establish policies and procedures for the acceptance and continuance of client relationships and specific engagements, designed to provide the firm with reasonable assurance that it will only undertake or continue relationships and engagements where the firm:
Is competent to perform the engagement and has the capabilities, including time and resources, to do so; (Ref: Para. A18, A23)
Can comply with relevant ethical requirements; and
Has considered the integrity of the client, and does not have information that would lead it to conclude that the client lacks integrity. (Ref: Para. A19–A20, A23)
The firm to obtain such information as it considers necessary in the circumstances before accepting an engagement with a new client when deciding whether to continue an existing engagement and when considering acceptance of a new engagement with an existing client. (Ref: Para. A21, A23)
If a potential conflict of interest is identified in accepting an engagement from a new or an existing client, the firm to determine whether it is appropriate to accept the engagement.
If issues have been identified, and the firm decides to accept or continue the client relationship or a specific engagement, the firm to document how the issues were resolved.
The firm shall establish policies and procedures on continuing an engagement and the client relationship, addressing the circumstances where the firm obtains the information that would have caused it to decline the engagement had that information been available earlier. Such policies and procedures shall include consideration of:
The professional and legal responsibilities that apply to the circumstances, including whether there is a requirement for the firm to report to the person or persons who made the appointment or, in some cases, to regulatory authorities; and
The possibility of withdrawing from the engagement or from both the engagement and the client relationship. (Ref: Para. A22–A23)
Competence, Capabilities, and Resources (Ref: Para. 26(a))
胜任能力、素质和资源(参见:第 26 段第(a)项)
Para A18
Consideration of whether the firm has the competence, capabilities, and resources to undertake a new engagement from a new or an existing client involves reviewing the specific requirements of the engagement and the existing partner and staff profiles at all relevant levels, including whether:
Firm personnel have knowledge of relevant industries or subject matters;
Firm personnel have experience with relevant regulatory or reporting requirements, or the ability to gain the necessary skills and knowledge effectively;
The firm has sufficient personnel with the necessary competence and capabilities;
Experts are available if needed;
Individuals meeting the criteria and eligibility requirements to perform engagement quality control review are available, where applicable; and
The firm is able to complete the engagement within the reporting deadline.
With regard to the integrity of a client, matters to consider include, for example:
The identity and business reputation of the client’s principal owners, key management, and those charged with its governance.
The nature of the client’s operations, including its business practices.
Information concerning the attitude of the client’s principal owners, key management and those charged with its governance towards such matters as an aggressive interpretation of accounting standards and the internal control environment.
Whether the client is aggressively concerned with maintaining the firm’s fees as low as possible.
Indications of an inappropriate limitation in the scope of work.
Indications that the client might be involved in money laundering or other criminal activities.
The reasons for the proposed appointment of the firm and non-reappointment of the previous firm.
The identity and business reputation of related parties.
The extent of knowledge a firm will have regarding the integrity of a client will generally grow within the context of an ongoing relationship with that client.
针对客户的诚信,会计师事务所考虑的事项包括:
客户主要股东、关键管理人员及治理层的身份和商业信誉;
客户的经营性质,包括其业务;
客户主要股东、关键管理人员及治理层对有关会计准则的偏激解释及内部控制环境的态度;
客户是否过分考虑将事务所的收费维持在尽可能低的水准;
工作范围受到不适当限制的迹象;
客户可能涉嫌洗钱或其他刑事犯罪活动的迹象;
变更会计师事务所的理由;
关联方的身份和商业信誉。
会计师事务所对客户诚信的了解程度,通常随着与客户关系的持续发展而加深。
Para A20
Sources of information on such matters obtained by the firm may include the following:
Communications with existing or previous providers of professional accountancy services to the client in accordance with relevant ethical requirements, and discussions with other third parties.
Inquiry of other firm personnel or third parties such as bankers, legal counsel and industry peers.
Continuance of Client Relationship (Ref: Para. 27(a))
客户关系的保持(参见:第 27 段第(a)项)
Para A21
Deciding whether to continue a client relationship includes consideration of significant matters that have arisen during the current or previous engagements and their implications for continuing the relationship. For example, a client may have started to expand its business operations into an area where the firm does not possess the necessary expertise.
Policies and procedures on withdrawal from an engagement or from both the engagement and the client relationship address issues that include the following:
Discuss with the appropriate level of the client’s management and those charged with its governance the appropriate action that the firm might take based on the relevant facts and circumstances.
If the firm determines that it is appropriate to withdraw, discuss with the appropriate level of the client’s management and those charged with its governance withdrawal from the engagement or from both the engagement and the client relationship, and the reasons for the withdrawal.
Considering whether there is a professional, legal or regulatory requirement for the firm to remain in place, or for the firm to report the withdrawal from the engagement, or from both the engagement and the client relationship, together with the reasons for the withdrawal, to regulatory authorities.
Documenting significant matters, consultations, conclusions and the basis for the conclusions.
Considerations Specific to Public Sector Audit Organizations (Ref: Para. 26–28)
对公共部门实体审计机构的特殊考虑(参见:第 26-28 段)
Para A23
In the public sector, auditors may be appointed in accordance with statutory procedures. Accordingly, certain of the requirements and considerations regarding the acceptance and continuance of client relationships and specific engagements as set out in paragraphs 26–28 and A18–A22 may not be relevant.
Nonetheless, establishing policies and procedures as described may provide valuable information to public sector auditors in performing risk assessments and in carrying out reporting responsibilities.
The firm shall establish policies and procedures designed to provide it with reasonable assurance that it has sufficient personnel with the competence, capabilities, and commitment to ethical principles necessary to:
Perform engagements in accordance with professional standards and applicable legal and regulatory requirements; and
Enable the firm or engagement partners to issue reports that are appropriate in the circumstances. (Ref: Para. A24–A29)
The firm shall assign responsibility for each engagement to an engagement partner and shall establish policies and procedures requiring that:
The identity and role of the engagement partner are communicated to key members of client management and those charged with governance;
The engagement partner has the appropriate competence, capabilities, and authority to perform the role; and
The responsibilities of the engagement partner are clearly defined and communicated to that partner. (Ref: Para. A30)
会计师事务所应当对每项业务委派一名项目合伙人,并应当制定政策和程序,明确下列要求:
将项目合伙人的身份和作用告知客户管理层和治理层的关键成员;
项目合伙人具有履行职责所要求的适当胜任能力、必要素质和权限;
清楚界定项目合伙人的职责,并告知该项目合伙人。 (参见:第 A30段)
Para 31
The firm shall also establish policies and procedures to assign appropriate personnel with the necessary competence and capabilities to:
Perform engagements in accordance with professional standards and applicable legal and regulatory requirements; and
Enable the firm or engagement partners to issue reports that are appropriate in the circumstances. (Ref: Para. A31)
会计师事务所还应当制定政策和程序,委派具有必要胜任能力和素质的适当人员,以:
按照职业准则和适用的法律法规的规定执行业务;
使会计师事务所或项目合伙人能够出具适合具体情况的报告。 (参见:第 A31 段)
Human Resources (Ref: Para. 29)
人力資源(參見:第 29 段)
A24.
Personnel issues relevant to the firm’s policies and procedures related to human resources include, for example:
Recruitment.
Performance evaluation.
Capabilities, including time to perform assignments.
Competence.
Career development.
Promotion.
Compensation.
The estimation of personnel needs.
Effective recruitment processes and procedures help the firm select individuals of integrity who have the capacity to develop the competence and capabilities necessary to perform the firm’s work and possess the appropriate characteristics to enable them to perform competently.
Competence can be developed through a variety of methods, including the following:
Professional education.
Continuing professional development, including training.
Work experience.
Coaching by more experienced staff, for example, other members of the engagement team.
Independence education for personnel who are required to be independent.
通过下列途径可以提高人员的胜任能力:
职业教育;
持续职业发展,包括培训;
工作经验;
由经验更丰富的员工(如项目组的其他成员)提供辅导;
针对受独立性要求约束的人员进行独立性教育。
A26
The continuing competence of the firm’s personnel depends to a significant extent on an appropriate level of continuing professional development so that personnel maintain their knowledge and capabilities.
Effective policies and procedures emphasize the need for continuing training for all levels of firm personnel and provide the necessary training resources and assistance to enable personnel to develop and maintain the required competence and capabilities.
The firm may use a suitably qualified external person, for example, when internal technical and training resources are unavailable.
会计师事务所可利用具有适当资格的外部人员,例如,当会计师事务所内部不具备技术和培训资源时。
A28
Performance evaluation, compensation and promotion procedures give due recognition and reward to the development and maintenance of competence and commitment to ethical principles. Steps a firm may take in developing and maintaining competence and commitment to ethical principles include:
Making personnel aware of the firm’s expectations regarding performance and ethical principles;
Providing personnel with an evaluation of, and counselling on, performance, progress and career development; and
Helping personnel understand that advancement to positions of greater responsibility depends, among other things, upon performance quality and adherence to ethical principles, and that failure to comply with the firm’s policies and procedures may result in disciplinary action.
Considerations Specific to Smaller Firms
对小型会计师事务所的特殊考虑
A29
The size and circumstances of the firm will influence the structure of the firm’s performance evaluation process. Smaller firms, in particular, may employ less formal methods of evaluating the performance of their personnel.
Assignment of Engagement Teams Engagement Partners (Ref: Para. 30)
项目合伙人(参见:第 30 段)
A30
Policies and procedures may include systems to monitor the workload and availability of engagement partners so as to enable these individuals to have sufficient time to adequately discharge their responsibilities.
The firm’s assignment of engagement teams and the determination of the level of supervision required, include, for example, consideration of the engagement team’s:
Understanding of, and practical experience with, engagements of a similar nature and complexity through appropriate training and participation;
Understanding of professional standards and applicable legal and regulatory requirements;
Technical knowledge and expertise, including knowledge of relevant information technology;
Knowledge of relevant industries in which the clients operate;
Ability to apply professional judgment; and
Understanding of the firm’s quality control policies and procedures.
The firm shall establish policies and procedures designed to provide it with reasonable assurance that the firm and its personnel comply with relevant ethical requirements.
第20段:会计师事务所应当制定政策和程序,以合理保证会计师事务所及其人
员遵守相关职业道德要求。
Independence | 独立性
Para 21:
The firm shall establish policies and procedures designed to provide it with reasonable assurance that the firm, its personnel and, where applicable, others subject to independence requirements (including network firm personnel) maintain independence where required by relevant ethical requirements.
Such policies and procedures shall enable the firm to (Ref: Para. A10)
Communicate its independence requirements to its personnel and, where applicable, others subject to them; and
Identify and evaluate circumstances and relationships that create threats to independence, and take appropriate action to eliminate those threats or reduce them to an acceptable level by applying safeguards, or, if considered appropriate, to withdraw from the engagement, where withdrawal is possible under applicable law or regulation.
Such policies and procedures shall require: (Ref: Para. A10)
Engagement partners to provide the firm with relevant information about client engagements, including the scope of services, to enable the firm to evaluate the overall impact, if any, on independence requirements;
Personnel to promptly notify the firm of circumstances and relationships that create a threat to independence so that appropriate action can be taken; and
The accumulation and communication of relevant information to appropriate personnel so that:
The firm and its personnel can readily determine whether they satisfy independence requirements;
The firm can maintain and update its records relating to independence; and
The firm can take appropriate action regarding identified threats to independence that are not at an acceptable level.
The firm shall establish policies and procedures designed to provide it with reasonable assurance that it is notified of breaches of independence requirements and to enable it to take appropriate actions to resolve such situations.
The policies and procedures shall include requirements for: (Ref: Para. A10)
Personnel to promptly notify the firm of independence breaches of which they become aware;
The firm to promptly communicate identified breaches of these policies and procedures to:
The engagement partner who, with the firm, needs to address the breach; and
Other relevant personnel in the firm and, where appropriate, the network, and those subject to the independence requirements who need to take appropriate action; and
Prompt communication to the firm, if necessary, by the engagement partner and the other individuals referred to in subparagraph 23(b)(ii) of the actions taken to resolve the matter, so that the firm can determine whether it should take further action.
At least annually, the firm shall obtain written confirmation of compliance with its policies and procedures on independence from all firm personnel required to be independent by relevant ethical requirements. (Ref: Para. A10–A11)
The firm shall establish policies and procedures: (Ref: Para. A10)
Setting out criteria for determining the need for safeguards to reduce the familiarity threat to an acceptable level when using the same senior personnel on an assurance engagement over a long period of time; and
Requiring, for audits of financial statements of listed entities, the rotation of the engagement partner and the individuals responsible for engagement quality control review, and, where applicable, others subject to rotation requirements, after a specified period in compliance with relevant ethical requirements. (Ref: Para. A12–A17)
Compliance with Relevant Ethical Requirements (Ref: Para. 20)
遵守相关职业道德要求(参见:第 20 段)
A7.
The IESBA Code establishes the fundamental principles of professional ethics, which include:
Integrity;
Objectivity;
Professional competence and due care;
Confidentiality; and
Professional behaviour.
国际职业会计师道德守则规定了职业道德基本原则,包括:
诚信;
客观;
专业胜任能力和应有的关注;
保密;
职业行为。
A8.
Part B of the IESBA Code illustrates how the conceptual framework is to be applied in specific situations. It provides examples of safeguards that may be appropriate to address threats to compliance with the fundamental principles and also provides examples of situations where safeguards are not available to address the threats.
国际职业会计师道德守则的 B 部分说明了如何在具体情形下运用概念框架,并且举例说明为处理对遵守职业道德基本原则产生不利影响的情形而采取的适当防范措施,以及无法采取防范措施以应对不利影响的情形。
A9.
The fundamental principles are reinforced in particular by:
The leadership of the firm;
Education and training;
Monitoring; and
A process for dealing with non-compliance.
Definition of “Firm,” “Network” and “Network Firm” (Ref: Para. 20–25)
下列途径尤其强化了职业道德基本原则:
会计师事务所领导层的示范;
教育和培训;
监控;
对违规行为的处理。
“会计师事务所”、“网络”及“网络事务所”的定义(参见:第 20-25段)
A10.
The definitions of “firm,” network” or “network firm” in relevant ethical requirements may differ from those set out in this ISA. For example, the IESBA Code3 defines the “firm” as:
A sole practitioner, partnership or corporation of professional accountants;
An entity that controls such parties through ownership, the management or other means; and
An entity is controlled by such parties through ownership, management or other means.
The IESBA Code also provides guidance in relation to the terms “network” and “network firm.”
In complying with the requirements in paragraphs 20–25, the definitions used in the relevant ethical requirements apply in so far as is necessary to interpret those ethical requirements.
Written confirmation may be in paper or electronic form.
By obtaining confirmation and taking appropriate action on information indicating non-compliance, the firm demonstrates the importance that it attaches to independence and makes the issue current for, and visible to, its personnel.
The IESBA Code discusses the familiarity threat that may be created by using the same senior personnel on an assurance engagement over a long period of time and the safeguards that might be appropriate to address such threats.
Determining appropriate criteria to address familiarity threats may include matters such as:
The nature of the engagement, including the extent to which it involves a matter of public interest; and
The length of service of the senior personnel on the engagement.
Examples of safeguards include rotating the senior personnel or requiring an engagement quality control review.
确定适当的标准以应对因密切关系产生的不利影响时,会计师事务所可能考虑下列事项:
业务的性质,包括涉及公众利益的程度;
高级人员提供该项业务的服务年限。
防范措施包括轮换高级人员,或要求实施项目质量控制覆核。
A14.
The IESBA Code recognizes that the familiarity threat is particularly relevant in the context of financial statement audits of listed entities.
For these audits, the IESBA Code requires the rotation of the key audit partner after a pre-defined period, normally no more than seven years, and provides related standards and guidance. National requirements may establish shorter rotation periods.
Considerations specific to public sector audit organizations
对公共部门实体审计机构的特殊考虑
A15.
Statutory measures may provide safeguards for the independence of public sector auditors.
However, threats to independence may still exist regardless of any statutory measures designed to protect it.
Therefore, in establishing the policies and procedures required by paragraphs 20–25, the public sector auditor may have regarded the public sector mandate and addressed any threats to independence in that context.
Listed entities as referred to in paragraphs 25 and A14 are not common in the public sector. However, there may be other public sector entities that are significant due to size, complexity or public interest aspects, and which consequently have a wide range of stakeholders. Therefore, there may be instances when a firm determines, based on its quality control policies and procedures, that a public sector entity is significant for the purposes of expanded quality control procedures.
In the public sector, legislation may establish the appointments and terms of office of the auditor with engagement partner responsibility. As a result, it may not be possible to comply strictly with the engagement partner rotation requirements envisaged for listed entities. Nonetheless, for public sector entities considered significant, as noted in paragraph A16, it may be in the public interest for public sector audit organizations to establish policies and procedures to promote compliance with the spirit of rotation of engagement partner responsibility.
The firm shall establish policies and procedures designed to promote an internal culture recognizing that quality is essential in performing engagements.
第18段:会计师事务所应当制定政策和程序,培育以质量为导向的内部文化。
Such policies and procedures shall require the firm’s chief executive officer (or equivalent) or, if appropriate, the firm’s managing board of partners (or equivalent) to assume ultimate responsibility for the firm’s system of quality control.
The firm’s leadership and the examples it sets significantly influence the internal culture of the firm.
The promotion of a quality-oriented internal culture depends on clear, consistent and frequent actions and messages from all levels of the firm’s management that emphasize the firm’s quality control policies and procedures, and the requirement to:
perform work that complies with professional standards and applicable legal and regulatory requirements; and
issue reports that are appropriate in the circumstances.
Such actions and messages encourage a culture that recognizes and rewards high-quality work.
These actions and messages may be communicated by, but are not limited to, training seminars, meetings, formal or informal dialogue, mission statements, newsletters, or briefing memoranda.
They may be incorporated in the firm’s internal documentation and training materials, and in partner and staff appraisal procedures such that they will support and reinforce the firm’s view on the importance of quality and how, practically, it is to be achieved.
Of particular importance in promoting an internal culture based on quality is the need for the firm’s leadership to recognize that the firm’s business strategy is subject to the overriding requirement for the firm to achieve quality in all the engagements that the firm performs.
Promoting such an internal culture includes:
Establishment of policies and procedures that address performance evaluation, compensation, and promotion (including incentive systems) with regard to its personnel, in order to demonstrate the firm’s overriding commitment to quality;
Assignment of management responsibilities so that commercial considerations do not override the quality of work performed; and
Provision of sufficient resources for the development, documentation and support of its quality control policies and procedures
The firm shall establish policies and procedures such that any person or persons assigned operational responsibility for the firm’s system of quality control by the firm’s chief executive officer or managing board of partners has sufficient and appropriate experience and ability, and the necessary authority, to assume that responsibility.
Assigning Operational Responsibility for the Firm’s System of Quality Control
Sufficient and appropriate experience and ability enable the person or persons responsible for the firm’s system of quality control to identify and understand quality control issues and to develop appropriate policies and procedures.
Necessary authority enables the person or persons to implement those policies and procedures.
Litigation brought against the Firm for alleged violations of professional conduct;
Incorrect opinion from the auditor, and as a result, boosted confidence in the reliability of the financial statements among investors
审计事务所必须确保他们的审计工作遵守质量标准,其目的是减少以下的风险:
审计事务所因涉嫌违反职业行为而面对诉讼的风险;
审计师提供不正确意见的风险,并因此增强投资者对财务报表可靠性的信心
There are 2 Different Quality Control Standards
At the firm level:
the International Standard on Quality Control 1 (ISQC 1) is Quality Control for Firms that carry out audits and reviews [*]
At the individual AUDIT level:
International Standard on Auditing [ISA] 220 Quality Control for an Audit of Financial Statements [*] is specific to audit engagements and contains specific requirements that should be adhered to in the performance of any audit.
ISA 220 Quality Management for an Audit of Financial Statements replaces Quality Control for an Audit of Financial Statements
[*] – 然而,即将在2022年12月15日生效:-
ISQM 1 取代了 ISQC 1;
ISA 220 财务报表审计的质量管理取代财务报表审计的质量控制
*Quick note to Audit Firms:
Firms are recommended to research the requirements of the three new quality management standards that have been adopted by the International Auditing and Assurance Standards Board (IAASB). These standards are scheduled to become effective on December 15, 2022.
The standards, which include the International Standards on Quality Management ISQM 1 and ISQM 2, as well as the International Standard on Auditing ISA 220 Revised, are an evolution from a traditional, more linear approach to quality control.
They are intended to create a more robust System of Quality Management for Firms that use the standards developed by the International Auditing and Assurance Standards Board (IAASB). The new standards provide an approach to audit quality management that is robust, scalable, and proactive. This approach is essential to ensuring that the auditing profession will continue to be trusted and viable in the future.
18
Hello 👋 Which service are you looking for? Let us know! 👇 ✅ Audit ✅ Tax ✅ Accounting ✅ Transfer Pricing ✅ E-invoice ✅ SST ✅ Others