Firm-level quality management - Monitoring, remediation, and...

Learning Outcomes

After reading this article, you will be able to explain the purposes and process of firm-level quality management monitoring, identify and recommend appropriate remediation actions, and describe root-cause analysis in the context of audit quality. You will recognise the role of monitoring and remediation within a system of quality management, be able to evaluate deficiencies, and state the exam implications for insufficient or ineffective quality processes.

ACCA Audit and Assurance (AA) Syllabus

For ACCA Audit and Assurance (AA), you are required to understand the key firm-level quality management requirements and their application. On this topic, ensure you focus revision on:

• The objective and importance of firm-level quality management in audit.
• The requirement for monitoring and remediation of the quality management system, including evaluation of deficiencies.
• The process of root-cause analysis for identified deficiencies and the steps for effective remediation.
• Actions taken when quality management deficiencies are identified: reporting, remediation, and follow-up.
• How deficiencies in quality management can impact the audit engagement.
• Recommendations to address and prevent recurring deficiencies.

Test Your Knowledge

Attempt these questions before reading this article. If you find some difficult or cannot remember the answers, remember to look more closely at that area during your revision.

1. What is the primary objective of ongoing monitoring in a firm's quality management system?
2. When a deficiency in quality management is identified, which step should follow evaluation and documentation of the issue?
3. What is the purpose of root-cause analysis in the quality management process?
4. Name two potential consequences if a firm repeatedly fails to remediate identified audit quality deficiencies.

Introduction

Quality management at the firm level is essential to ensure all audit engagements are performed to required standards and that issued reports are appropriate. Quality management systems (QMS) are required to be maintained by all audit firms under the International Standard on Quality Management (ISQM 1). Central to this system are monitoring activities—regular checks to confirm the QMS is operating effectively—and remediation of any deficiencies. When issues in quality are identified, firms must investigate using root-cause analysis, implement remediation, and evaluate the effectiveness of their response.

Key Term: quality management system (QMS)
The policies, processes, and procedures an audit firm establishes to provide reasonable assurance that engagements comply with professional standards and that reports issued are appropriate.

Monitoring the Firm’s Quality Management System

Monitoring is an essential part of firm-level quality management. It provides assurance that the system is working as expected and identifies opportunities for improvement.

Monitoring activities include:

• Ongoing procedures (e.g., regular file reviews, observation) performed continuously throughout the year.
• Periodic reviews (e.g., annual internal quality reviews, file inspections).
• Review of engagement documentation for compliance with policies and standards.
• Assessment of staff compliance with ethical requirements and independence.

The results of these activities are documented, and findings or potential deficiencies are communicated to firm leadership.

Key Term: monitoring
The continual process of evaluating the design, implementation, and operation of a firm's quality management system through regular activities and reviews.

Identifying and Evaluating Deficiencies

A deficiency is any element of the QMS that is not operating, or is absent, such that quality objectives may not be achieved.

Deficiencies can be identified through:

• Monitoring procedures (file reviews, cold reviews, internal audit).
• Complaints from clients, regulators, or staff.
• Quality inspection reports from professional bodies or regulators.

All deficiencies must be evaluated to determine whether they are isolated incidents or indicate a more widespread problem.

Key Term: deficiency
A finding indicating an element of the QMS is missing, not designed or implemented properly, or not operating effectively, reducing the ability to achieve quality objectives.

Key Term: remediation
The process of taking corrective action to address and resolve identified deficiencies in the firm’s QMS.

Remediation Actions

Remediation is the firm's response to a deficiency, aiming to correct the problem and prevent recurrence.

Remediation steps typically include:

• Investigating the cause using root-cause analysis.
• Formulating an action plan to address the deficiency.
• Assigning responsibility for implementing actions.
• Monitoring that actions have been completed and are effective.
• Updating relevant policies and training if required.

If deficiencies indicate potential impact on current or completed engagements, the firm may need to take direct action, such as re-reviewing files, re-issuing reports, or notifying affected parties.

Worked Example 1.1

Scenario: A post-issuance review identifies a lack of documented supervisory review on several audit files in the past year. What should the firm do next?

Answer:

• Evaluate whether this is an isolated matter or widespread.
• Perform root-cause analysis to understand why reviews were not documented.
• Develop a remediation action plan (e.g., revise the review checklist, provide training).
• Monitor subsequent files to confirm documentation now occurs.
• Follow up if further deficiencies are identified.

Root-Cause Analysis

Root-cause analysis investigates why a deficiency occurred, aiming to identify root causes and prevent repeat issues.

A structured root-cause analysis process could include:

1. Clearly describing the deficiency.
2. Gathering all relevant information.
3. Asking "Why did this happen?" repeatedly (the "five whys" approach).
4. Identifying contributing and root causes (e.g., inadequate training, unclear procedures, excessive workloads).
5. Documenting findings and using them to inform the remediation plan.

Key Term: root-cause analysis
A systematic method of identifying the fundamental reason for a deficiency in the QMS, going beyond surface symptoms to fundamental factors.

Worked Example 1.2

Scenario: Engagement quality reviews consistently find insufficient documentation of significant professional judgments. Root-cause analysis identifies that reviewers lack clarity about what judgments must be documented.

Answer:
The root cause is ambiguity in the firm’s documentation policy. Remediation might involve updating written procedures to specify requirements, conducting targeted training, and reviewing a sample of files for improvement.

Follow-up and Continuous Improvement

Following remediation, firms must verify whether corrective actions have addressed the identified deficiencies. This is typically done by:

• Performing follow-up reviews to confirm implementation.
• Updating monitoring activity schedules based on results.
• Reporting outcomes to firm leadership.
• Recording all steps taken.

Continuous improvement is encouraged through periodic review and update of quality management objectives and controls.

Exam Warning

In the exam, ensure you always consider both immediate corrective actions and longer-term actions (such as changes in training or policies) when asked about remediation or quality improvements.

Revision Tip

Review recent published quality inspection findings by audit regulators to understand common firm quality deficiencies and how they are addressed.

Summary

Firm-level quality management relies on regular monitoring to ensure systems and controls are effective. When deficiencies are identified, firms must perform root-cause analysis and take swift remediation. Effective remediation not only corrects the problem but also prevents its recurrence and supports the overall aim of issuing appropriate audit reports. Exam questions often require you to describe how deficiencies are identified, how root-cause analysis is performed, and how to recommend appropriate remediation.

Key Point Checklist

This article has covered the following key knowledge points:

• Define firm-level quality management, monitoring, and remediation.
• Describe how monitoring is conducted and deficiencies are identified.
• Explain the step-by-step process for remediation, including root-cause analysis.
• Recommend actions for recurring deficiencies and document the remediation process.
• Recognise the consequences of failing to remediate deficiencies in audit quality.

Key Terms and Concepts

• quality management system (QMS)
• monitoring
• deficiency
• remediation
• root-cause analysis