In 2022, accounting firms in Australia and New Zealand undertaking audit and assurance were required to shift from a traditional quality control approach to a more comprehensive system of quality management.

This change is aligned with international auditing standards, aiming for long-term consistency and excellence in audit processes. However, the transition has not been smooth for all firms, particularly smaller ones, with many still developing their approach two years after the standard came in.

Under the international auditing standard ISQM 1 – Quality Management for Firms that Perform Audits or Reviews of Financial Statements, or Other Assurance or Related Services Engagements – firms must implement a quality management system tailored to the nature and circumstances of the firm and the engagements being performed. In Australia, the standard is ASQM 1, and for New Zealand’s regulations refer to CA ANZ article ‘Audit Regulation in NZ’.

While it is intended to be a scalable, risk-based approach specific to each firm, many have adopted a template-based approach and still need to tailor the risks and policies more closely to their firm’s circumstances, says Paul Selwyn-Smith CA, manager NZ audit oversight at NZICA.

“The standard aims to make the process more proactive – essentially creating a feedback loop. The idea is to continuously monitor for things that might not have gone quite right and analyse why that happened,” he says.

“Once identified, the focus is on figuring out what can be done to fix the issue and how to adjust policies and procedures to prevent it from recurring.”

This feedback-driven approach is new for many firms and, as it requires a significant mindset shift, some are finding it challenging to adapt, he adds.

It raises an important question: should smaller firms invest in developing a quality management system to stay compliant, or reconsider offering audits altogether?

“It depends on the business,” says Selwyn-Smith.

“For some small firms where audits are not a core service, the effort to implement quality management may not justify the return.”

He suggests that such firms could either consider expanding their audit practice to make it more worthwhile or exit the market if the investment in quality management doesn’t align with their business goals.

Shift in standards

While there are resources available for firms seeking assistance in developing a quality management system, the number of practitioners providing assurance services looks set to decrease in the near future. This is due to the time demands in providing audit and assurance services and a shortage in the availability of skilled staff resources, which have resulted in a significant increase in the costs associated with ensuring compliance with auditing standards, says quality reviewer Robert Magnussen FCA.

“After going through a quality review, some firms decide that the risks and costs of continuing to offer audit and assurance services outweigh the benefits, and elect to cease providing such services. This is particularly the case where firms derive only a very small percentage of their fees from audit and assurance services,” he says.

“This situation presents opportunities for smaller firms that decide to continue to offer audit and assurance services, as their comparatively lower costs and overheads generally make their pricing more competitive than that of big four and second-tier firms,” he says.

For those that are committed to offering audit and assurance services, the process of developing a quality management system begins with defining firm-specific quality objectives.

“Firstly, firms must establish their quality objectives, which are set out in ASQM 1. In some cases – for example, sole practitioners – not all the quality objectives may be applicable.

“The principal objective of the firm is to design, implement and operate a system of quality management that provides the firm with reasonable assurance that the firm conducts audit and assurance engagements in accordance with auditing standards, and that audit and assurance reports issued are appropriate in the circumstances,” says Magnussen.

Once the quality objectives are defined, the next step is to apply a risk-based approach: identifying and assessing risks that may prevent a firm from achieving these objectives.

“For example, if the quality objective is to ensure that engagement team members understand and fulfil their responsibilities in connection with audit engagements, a key risk might be inadequate staff training and a lack of appropriate direction or supervision, as well as deficiencies in the extent of the review of the audit work performed.

“To address this risk, safeguards must be implemented – most importantly, ensuring that staff receive appropriate training, guidance and supervision, and that work performed by less experienced engagement team members is reviewed by more experienced engagement team members,” says Magnussen.

Investing in the future

A typical situation of a business that has yet to comply with the new standard could be in a two-partner firm, where one partner specialises in business services and tax, while the other focuses on audit and assurance, as well as other business services, says quality reviewer Sonya Sinclair CA.

“While these types of firms typically have good processes in place, the partner handling audit and assurance may not realise that the system of quality control has been replaced by ISQM 1,” she says.

This often happens in smaller firms, where the focus is on day-to-day practice management, she adds.

“My advice is to take some time and seek practical help because when a firm starts assessing the risks related to core areas like ethical requirements, acceptance and continuance, and engagement performance, things can get tricky. Identifying and applying these risks to their firm is where the confusion comes in.”

Once you have developed the system, it is not arduous to maintain it, says Sinclair.

“It may take some time and effort to start with but it is scalable, which means smaller firms can tailor their quality management system to fit their specific needs, without the need to implement the same level of complexity as larger firms.”

And the consequences of not complying can impact the business.

“Your insurance could be at risk,” says Sinclair. “If you don't have the necessary systems in place, your professional indemnity insurance might not cover you.”