One size no longer fits all
New auditing standards exposure drafts move quality management standards to principles-based approach.
May 19, 2021
By Melisa Galasso, CPA
On Feb. 4, 2021, the American Institute of CPAs (AICPA) Auditing Standards Board (ASB) issued a three-part exposure draft addressing quality management. Two of the exposure drafts would create Statements on Quality Management Standards (SQMS) to replace the current Statements on Quality Control Standards (SQCS). The third exposure draft would update the Statements on Auditing Standards (SAS) to incorporate the concept of a system of quality management. The project is a convergence project with the International Auditing and Assurance Standards Board (IAASB). Comments are due on Aug. 31, 2021.
Proposed SQMS 1
SQMS 1 — Proposed Statement on Quality Management Standards, A Firm’s System of Quality Management, was issued to improve scalability and remove a one-size-fits-all quality control concept. Instead, a principles-based, risk-based approach to quality will be more scalable and address regulators’ concerns.
Unlike extant QC Section 10, the new approach requires a firm to customize the design, implementation and operation of its system of quality management. Now, firms will be unable to simply rely solely on third-party practice aids. They will need to perform their own risk assessment based on the types of engagements, clients and industries and develop an appropriate response for the risks identified. The proposal asks firms to move from a policies and procedures methodology focused on standalone elements to the concept of a system of quality control that is integrated and iterative.
The AICPA has updated the components of QM to include:
- The firm’s risk assessment process (new).
- Governance and leadership (adapted from the leadership responsibilities for quality within the firm component in QC Section 10).
- Relevant ethical requirements (same name as component in QC Section 10).
- Acceptance and continuance of client relationships and specific engagements (same name as component in QC Section 10).
- Engagement performance (same name as component in QC Section 10).
- Resources (adapted from the human resources component in QC Section 10).
- Information and communication (new).
- The monitoring and remediation process (adapted from the monitoring component in QC Section 10).
The risk-based approach would require a firm to establish quality objectives; some are required by SQMS 1, but additional objectives may be necessary. Then the firm would identify and assess the risks and respond by designing and implementing responses to those risks.
Proposed SQMS 1 would be required to be designed and implemented by Dec. 15, 2023. The evaluation of the system of quality management required by proposed SQMS would be required to be performed within one year following Dec. 15, 2023.
Proposed SQMS 2
SQMS 2 — Proposed Statement on Quality Management Standards, Engagement Quality Reviews, applies to all engagements for which an engagement quality review is required to be performed as a specified response designed and implemented by the firm in accordance with SQMS 1. The AICPA continues to allow firms the flexibility to decide when a quality review is required. SQMS 2 would not apply if a firm did not identify any engagements that required a quality review based on SQMS 1.
The proposal would require firms to have policies and procedures on who has the authority to identify quality reviewers, as well as establish policies and procedures on the qualifications for those individuals. It also includes performance requirements that indicate what is expected of the quality reviewer.
To address threats to objectivity, the proposal includes a cooling-off period of two years or longer for individuals who previously served as the engagement partner, which is consistent with the IAASB requirements. Finally, the engagement partner is precluded from dating the report until notification has been received from the engagement quality reviewer that the engagement review is complete.
Proposed SAS
The last proposal, SAS, Quality Management for an Engagement Conducted in Accordance with Generally Accepted Auditing Standards (GAAS), addresses how the engagement partner leverages the system of quality control from SQMS 1 and manages quality at the engagement level (an individual audit). The proposal identifies key items for which the engagement partner can not delegate their responsibility. It also provides explicit requirements for the engagement partner’s responsibility for leadership, direction, supervision and review, as well as includes a stand-back provision for acceptance of overall quality. This proposal is expected to be effective for engagements conducted in accordance with GAAS for periods beginning on or after Dec. 15, 2023.
As these proposals include significant changes to the firm’s processes, policies and procedures, the AICPA would love to hear from firms of all sizes. Comments are due Aug. 31, 2021. View the PDF of all three proposals.
Melisa Galasso, CPA, is founder & CEO of Galasso Learning Solutions in Charlotte, N.C. An accounting and auditing standards expert, Melisa is a previous member of the VSCPA Board of Directors, currently sits on the Editorial Task Force, and is a nominee to AICPA Council.