Global Quality Control Initiative Moves Forward
By Tom Riesenberg
What is likely to be the most significant step towards improving audit quality since the enactment of the Sarbanes-Oxley Act is taking place without much fanfare, at least thus far. And, unlike SOX, the initiative is coming from the profession itself.
The International Auditing and Assurance Standards Board (IAASB), which was established by the International Federation of Accountants (IFAC) to set international auditing standards, earlier this year published “Exposure Drafts for Quality Management at the Firm and Engagement Level, Including Engagement Quality Reviews.” The comment period, which officially ended on July 1st, has elicited approximately 100 comment letters to date.
The IAASB Exposure Drafts cover revisions to two existing standards and one new standard and are described as proposing a “substantial revision” of existing standards. The most important change is that ISQC 1, the current standard, would be replaced by ISQM 1 — that is, “quality control” will now be termed “quality management.” The new standard would require firms “to design, implement and operate an integrated system of quality management, including 1) identifying and assessing their quality risks, 2) designing and implementing responses to address the assessed quality risks, and 3) designing processes related to monitoring and remediation.” In other words, this standard would focus on outcomes — whether the controls yield the required results, and, if they don’t, what needs to be fixed. The existing quality control standard, by contrast, focuses on policies and procedures — which may (or may not) be effective.
The IAASB has described the proposed new system of quality management as having these benefits: it can be tailored for the nature and circumstances of the particular accounting firm; it should facilitate proactive responses to changing circumstances or risks and promote continual improvements; it emphasizes system-monitoring and time and effective remediation; and it will improve integration of the components of the overall control system. One commentator, from South Africa, summarized the change as “[i]n essence, the system of quality management requires a change from a mindless, tick-box exercise of establishing policies and procedures that address standalone elements of quality control to an integrated, proactive approach that reflects upon an entire system and requires continuous monitoring and remediation.”
This is a major change, and it will take the firms a lot of work to implement. The AICPA in its comment letter stated that “identifying and assessing the firm’s quality risks is the essence of this standard and will be a challenge for many firms.” The AICPA summarized what will need to be done:
“* Make the necessary organizational changes which, for many firms, will require the addition of additional resources,
* Design, implement, and document the risk assessment approach,
* Design, implement, and document the information and communication requirements,
* Design, implement, and document an enhanced monitoring and remediation process, and
* Design, implement, and document the effectiveness of the overall evaluation of the system of quality management. This requirement in particular will require time for firms to test new processes to ensure the system is operating effectively.”
Although this effort is coming from the international standard-setting body, it will apply to all US member firms of the large accounting firm networks that issue audit and attestation reports. This is because all the large firms are members of an organization called The Forum of Firms (FOF), an independent association of international networks of firms that perform transnational audits.
Members of the FOF agree, among other things, to comply with the quality control standards issued by the IAASB. Further, many global standard setting organizations, such as the AICPA, are IFAC members, which means the IAASB standards must (with certain exceptions) be incorporated into their local standards. Meanwhile, the PCAOB also has a quality control research project underway; according to the PCAOB’s website the staff has presented research findings to the Board “and is developing recommendations for next steps for Board consideration.”
The IAASB is proposing that the new standards take effect 18 months from approval by the Public Interest Oversight Board (which oversees the IAASB). Citing the amount of work that the new standards would require, the AICPA, Center for Audit Quality, major firms and others have stated in their comment letters that they will need at least 24 months from PIOB approval to implement the standards.
