Why quality management is more than just compliance

2022-07-06 - 02:16

Author: ICAEW Insights

With ISQM 1’s deadline on the horizon, firms are starting to think about how to comply. But it can be more than a compliance exercise.

It’s never pleasant to think that your practice needs to comply with a new set of standards. ISQM 1 is no exception. It’s easy to consider it as a burden; a piece of compliance that needs to be completed before the deadline.

But it could be more than that, as Matthew Howells, partner and Head of National Assurance Technical Group at Smith and Williamson, has discovered as the firm goes through the process of implementing ISQM 1.

“It is partly about managing what is a very real risk these days, it’s not just the big firms that have a reputational risk around poor audit quality. They’re the ones that tend to get the headlines. But for a firm like Smith and Williamson – and for smaller firms – that reputational risk is still there. Quality management and quality processes obviously guard against that.”

If you’re trying to improve your outcomes, and putting a more stringent quality management system in place, you should have better outcomes across the majority of your audit work, it should pick up problems sooner if it’s set up properly, says Howells.

“That’s got to be better for everybody involved. If QAD comes in, and outlines a number of issues in a file, that’s partner time, it’s people having to go in and work out what went wrong. So if that happens less, surely that’s a good thing.”

In the longer term, ISQM 1 could also have relevance beyond audit and to the rest of the firm as well, he adds. There’s no reason why it shouldn’t work for the tax or corporate finance side of a practice, he explains. “There can be lessons that come out of it that are of broader relevance right across the whole firm, potentially.”

Going through the process has also helped Smith and Williamson identify gaps that would have gone unnoticed without ISQM 1, he says. It encouraged them to look at things through a different lens, encouraging them to think about things in a more joined up way.

“Maybe there’s a process that relies on one person remembering to do something. So as long as that person is there, and they remember to do it, everything works and everything’s fine. The problem comes if either that person leaves, they’re off sick, or they’re on holiday, or they forget – that’s when things go wrong. Identifying areas like that is really helpful.”

The solutions are also relatively simple; in some cases, it’s merely a matter of setting a calendar reminder. These small things can help to prevent problems occurring in the first place. “That’s been actually really valuable for us.”

Having your risk management processes documented in one place is a huge benefit, especially in terms of continuity, says Howells. “People don’t have to keep reinventing the wheel all the time. If somebody new joins, it’s easy to explain to them how this process works.”

Although all firms have to comply with ISQM 1, each firm chooses how they comply, so there is also real potential for gaining competitive advantage, Howells explains. If you can articulate how you comply with the standard and what that means for the quality of the audit service, it could make the difference when a business is looking for a new auditor.

“With all of the various scandals that we’ve had over the last few years, there is more awareness and more questioning on the part of investors about the job that the auditors are doing,” says Howells. “That will then feed through into the questions that audit committee chairs and boards of directors ask us. We are seeing a greater interest and more questions about how we audit, value for money and what ‘good’ assurance looks like, rather than audit as a simple compliance exercise.”

One of the requirements of ISQM 1 is root cause analysis. Larger firms do it already as a matter of course, but with others, it varies.

Training is often cited as the answer when audit issues are identified, but it’s too easy to do broad training, tick a box and make little real difference to the audit work. Root cause analysis enables firms to pinpoint problems and be more targeted with the training that you invest in.

“It could be that several new managers joined the firm at the same time from different firms, and they look at things differently, for example. So if this is the root cause, you might need to make changes to your induction procedures.

“It comes back to the efficiency point again. If you know precisely what it is that’s causing a problem, you can do something about it. That’s really valuable.”