Printer Friendly

Addressing the new Quality Control Standards: an opportunity for improvement.

In October 2007, the AICPA's Auditing Standards Board (ASB) issued Statement on Quality Control Standards (SQCS) 7, A Firm's System of Quality Control. This new standard, which includes many significant changes and new requirements, was effective January 1, 2009. Accounting firms should become familiar with the standard in order to best handle its implementation.

How We Got Here

SQCS 1, System of Quality Control for a CPA Firm, issued in 1979, established the requirement that all CPA firms must have a system of quality control policies and procedures in their accounting and auditing practices. A quality control system is intended to provide the firm with reasonable assurance that its accounting and auditing engagements are performed and reported on in accordance with professional standards. In addition to establishing the quality control requirement, SQCS 1 defined nine elements of a quality control system. In the intervening 30 years, additional standards revised the elements of a system of quality control and provided additional guidance on their implementation. The Exhibit illustrates the evolution of the defined elements of a quality control system.
Evolution and Relationship of Quality Control Elements

SQCS 1 Elements      SQCS 2 Elements            SQCS 7 Elements

                                           Leadership responsibility
                                           for quality within the

Independence         Independence,         Relevant ethical
                     integrity, and        requirements

Acceptance and       Acceptance and        Acceptance and
continuation of      continuation of       continuation of client
clients              clients and           relationships and specific
                     engagements           engagements

Hiring               Personnel management  Human resources



Assigning personnel
to engagements

Supervision          Engagement            Engagement performance


Inspection           Monitoring            Monitoring

SQCS 2, System of Quality Control for a CPA Firm's Accounting and Auditing Practice, issued in 1996, superseded SQCS 1. The new standard replaced the nine specific quality control elements of SQCS 1 with five broad elements, while retaining many of the aspects of the original nine elements. In addition, SQCS 2 expanded the quality control requirement to include engagements performed under the attestation standards.

Like these predecessors, SQCS 7 applies only to a firm's accounting and auditing practice and should be read in conjunction with the AICPA Code of Professional Conduct. SQCS 7 reflects several changes from earlier standards. First, the standard not only expands the number of quality control elements to six, it also includes far more detailed guidance than the earlier standards. Second, the standard adds several more documentation requirements. Third, the standard introduces new required quality control procedures. Fourth, the standard provides guidance that is consistent with International Standards on Quality Control (ISQC).

Professional Responsibilities

Unlike previous standards, SQCS 7 sets forth the meaning of certain terms used in the SQCSs. Because all firms are required to have a system of quality control, the definitions add clarity as firms develop policies and procedures appropriate for their practices.

SQCS 7 includes both requirements and related guidance. The standard uses terminology consistent with other professional standards to describe the degree of responsibility the firm has in all cases where the circumstances exist. Unconditional requirements are to be complied with and use the words "must" and "is required." The standard only uses the word "must" twice--once in the definition of an unconditional requirement and once to actually state that a firm must establish a system of quality control.

A firm is also required to comply with presumptively mandatory requirements, but in rare circumstances it may depart from a requirement (provided the firm documents its justification and the alternative procedures employed). Presumptively mandatory requirements use the word "should." The standard uses it approximately 80 times. Accordingly, it is highly unlikely that a firm would find all 80 requirements applicable in its own situation. It is important to note, however, that "should" often really means "must." For example, there does not seem to be any defensible position for a firm not having a quality control document or procedures for documenting the operation of the system. The goal is for a firm to have a comprehensive quality control document. Accordingly, firms are advised to use caution when departing from a presumptively mandatory requirement and to provide a documented record supporting their decision. For the purposes of this discussion, the presumptively mandatory language of SQCS 7 will be used.

SQCS 7 also includes explanatory material to provide further clarification and guidance on the professional requirements or to identify and describe related procedures or actions. Explanatory material uses the words "may," "might," and "could" to describe these actions and procedures.

Elements of a System of Quality Control

A system of quality control consists of policies designed to achieve performance objectives and the procedures to implement and monitor compliance with those policies. These policies and procedures should address each of the following elements:

* Leadership responsibility for quality within the firm,

* Relevant ethical requirements,

* Acceptance and continuation of client relationships and specific engagements,

* Human resources,

* Engagement performance, and

* Monitoring.

A firm should document its quality control policies and procedures. The extent of documentation will vary by the size, structure, and nature of the firm's practice. In a similar manner, the quality control policies and procedures should require appropriate documentation to provide evidence of the operation of each element. A firm should communicate--not necessarily in writing--its quality control policies and procedures to all personnel associated with engagements covered by the standard. A discussion of each quality control element follows.

Leadership responsibility for quality within the firm. Also known as the "tone at the top," this is the newest--and perhaps the most critical--quality control element. A firm's leadership should create an internal culture that recognizes and rewards quality in the performance of engagements. That leadership should also demonstrate and communicate its commitment to quality by the following:

* Assigning management responsibilities so that commercial considerations do not override the quality of the work performed;

* Incorporating quality of work as a factor in performance evaluations, compensation, and advancement of personnel; and

* Devoting sufficient and appropriate resources for the development and support of quality control policies and procedures.

A firm's leadership may assign operational responsibility and authority for the firm's quality control to individuals having sufficient and appropriate experience, an understanding of quality control issues, and the ability to develop and implement policies and procedures. The firm's leadership, however, retains the overall responsibility to establish an environment in which each individual is responsible for being familiar with and complying with the quality control policies and procedures.

Perhaps the most meaningful and transparent way that a firm's leadership can convey the importance of quality work is to ensure that the individuals assigned the quality control operational responsibility are given the authority and visibility on engagement matters and that they are recognized within the firm for their contributions as a critical and valued service.

Relevant ethical requirements. A modification of the former independence, integrity, and objectivity quality control element, the ethical requirements relevant to a firm's engagements can come from a variety of sources, including the AICPA Code of Professional Conduct, state boards of accountancy, and applicable regulatory agencies. SQCS 7, however, focuses primarily on policies and procedures associated with compliance with independence requirements. This can be a challenging task, given the lack of consistency across the various sources of ethical requirements.

The most significant change is the requirement--at least annually--to obtain from all firm personnel a written confirmation of their compliance with the firm's policies and procedures on independence. The confirmation can be in either written or electronic format.

Acceptance and continuation of client relationships and specific engagements. This is a further refinement of the original client acceptance element. The quality control policies and procedures should provide reasonable assurances that the firm will only undertake or continue relationships and engagements where the firm has done the following:

* Considered the integrity of the client's owners, management, related parties, and others charged with governance;

* Considered the risk associated with providing professional services in the particular circumstances;

* Acquired the competencies, capabilities, and resources to do so;

* Complied with legal and ethical requirements; and

* Reached an understanding with the client regarding the services to be performed.

Many of the new requirements reflect what may have been considered best practices in the past.

If issues are identified but a firm accepts or continues the client relationship or the specific engagement, the firm should document how the issues were resolved. Likewise, a firm should fully document any matters associated with the decision to withdraw from an engagement or client relationship.

Human resources. Formerly referred to as "personnel management," a firm's policies and procedures for human resources should address the following:

* Recruiting and hiring;

* Determining capabilities and competencies;

* Assigning personnel to engagements;

* Professional development; and

* Performance evaluations, compensation, and advancement.

SQCS 7 includes an extended discussion of quality control policies and procedures to provide reasonable assurance that engagement partners possess the competencies necessary to fulfill their engagement responsibilities. This can be a challenging issue in smaller firms with extensive tax practices but a limited number of accounting and auditing engagements.

Engagement performance. This is an expansion of the previous engagement performance element and incorporates additional guidance related to policies and procedures for the performance, supervision, and review of engagements. Unlike earlier standards, SQCS 7 includes detailed guidance as to the policies and procedures needed to ensure the confidentiality, safe custody, integrity, accessibility, retrievability, and retention of engagement documentation. The guidance is consistent with Statement on Auditing Standards (SAS) 103, Audit Documentation, but it also applies to all engagements within a firm's accounting and auditing practice.

The engagement performance element also comprises required policies and procedures related to consultation. These include identifying consultation situations, maintaining sufficient appropriate resources, and establishing a consultation process. Procedures should be established to ensure the documentation of a consultation. The documentation should include the issue in question and the results of the consultation, including any decisions, the basis for the decisions, and their implementation. Similarly, SQCS 7 requires policies and procedures for dealing with and documenting the resolution of differences in opinion within the engagement team, with those consulted, and, where applicable, between the engagement partner and the engagement quality control reviewer (see below).

Perhaps the most significant change is the new engagement quality control review (EQCR) requirement. An EQCR is essentially a form of prerelease review. Every firm should establish criteria against which all engagements covered by SQCS 7 are evaluated in order to determine whether an EQCR is to be performed. The criteria should reflect the structure and nature of the firm's practice. In establishing its criteria, a firm may consider the type of engagement, any unusual circumstances or associated risks, and whether applicable laws or regulations require an EQCR.

A firm's EQCR criteria should be objective and specific enough to ensure that engagements are identifiable. For example, a firm's policy may state that all initial engagements in industries in which the firm has not had experience and all Yellow Book and A-133 audits are subject to an EQCR. While a firm is not required to have engagements that meet its EQCR criteria, it should not be setting its criteria such that no engagements qualify. For example, a firm whose practice is limited to reviews and compilations should not establish its EQCR requirement as all audit engagements. Ideally, the criteria should be risk-based, taking into consideration a firm's structure and the nature of its practice. In addition, if a firm already has a policy requiring a concurring prerelease review for all or certain engagements, the EQCR requirement will probably be satisfied.

If an engagement meets the established criteria, the EQCR should be performed by an individual who is not a member of the engagement team, possesses the necessary experience and technical competency, and has the authority to objectively complete the review. Sole practitioners with no staff and many small firms with limited staff will need to contract with qualified external persons. Unfortunately, a firm's outside peer reviewer cannot fill this need due to independence issues; the peer reviewer may, however, be able to recommend a qualified reviewer.

Although the individual performing the EQCR cannot be a member of the engagement team, the engagement partner may seek consultation with the reviewer during the performance of the engagement. The nature and extent of the consultation should be monitored to ensure that the objectivity of the EQCR is not impaired.

An EQCR consists of an objective evaluation of the significant judgments made and conclusions reached by the engagement team, by reviewing selected engagement workpapers and other documentation, as well as reading the financial statements or other subject matter and considering the appropriateness of the report. Based on the circumstances surrounding the engagement, the EQCR may also include an evaluation of the independence of the firm or engagement team, whether appropriate consultation was taken, and whether the workpapers support the significant judgments made and conclusion reached.

A firm's policies and procedures should require appropriate documentation of the performance of the EQCR according to the firm's policies prior to the report's release, as well as the fact that the reviewer was not aware of any unresolved matters that may have affected judgments made and conclusions reached on the engagement. The EQCR review should be completed before the report is released.

Monitoring. As a quality control element, the monitoring of policies and procedures should be designed to provide reasonable assurance that the firm's system of quality control is relevant, adequate, operating effectively, and complied with in practice. Monitoring responsibility should be assigned to a partner or others with sufficient appropriate experience and authority to assume the responsibility. Some of the actual monitoring procedures may be performed by other qualified individuals.

Monitoring procedures should be sufficiently comprehensive to assess a firm's compliance with all professional standards, regulatory requirements, and its own quality control policies and procedures. They should address the firm's compliance with the other five quality control elements. As such, monitoring procedures may include the following:

* Review of administrative and personnel records;

* Review of engagement working papers, reports, and financial statements;

* Discussions with engagement personnel;

* Determination of corrective actions on specific engagements;

* Consideration of the systemic cause of findings;

* Summarization of the findings, at least annually;

* Determination of improvements or modification in quality control policies or procedures;

* Communication of findings to appropriate firm personnel; and

* Consideration of findings by the firm's leadership assigned the operational responsibility and authority for quality control.

Monitoring procedures should reflect an ongoing evaluation of the appropriateness of the design and operating effectiveness of the quality control system and should address all quality control elements. The inspection of selected engagements for compliance with professional standards and the firm's quality control policies and procedures is an important monitoring aspect related to the engagement performance element. While EQCRs are part of engagement performance, they can also be part of the monitoring process if identified engagement deficiencies are incorporated with other monitoring findings.

Ideally, monitoring procedures should not be performed by the same individual responsible for compliance with the firm's quality control policies and procedures. SQCS 7 permits individuals to inspect their own work product for compliance; however, smaller firms and sole practitioners may find it more effective and cost-efficient to engage a qualified individual from outside the firm.

Regardless of whether the inspection and monitoring procedures are performed by internal or external personnel, identified deficiencies should be communicated to the relevant engagement partners and other appropriate firm personnel. An evaluation of the deficiencies should result in recommendations that may include remedial actions for specific engagements or personnel, additional training or professional development activities, or changes in the firm's quality control policies and procedures. The results of the monitoring of the quality control system should be communicated to the relevant engagement partners and other appropriate firm personnel, including the firm's leadership, at least annually. The firm's policies and procedures should also require adequate documentation of the monitoring process, activities, findings, and conclusions.

An added consideration under monitoring is the requirement to establish policies and procedures to address complaints and allegations originating from within or outside the firm. Such matters might include the firm's work failing to comply with professional, legal, or regulatory requirements; instances of noncompliance with the firm's system of quality control; or deficiencies in the design or operation of the quality control system. The policies and procedures should include a process whereby firm personnel can come forward without fear of reprisals, as well as the required documentation of complaints and allegations, and the firm's response to them.

Implementing the New Standard

How a firm addresses the transition to SQCS 7 will depend, in part, on the status of the implementation and documentation of its quality control system under the former standards. Nevertheless, the starting point is for the firm's leadership to demonstratively acknowledge its responsibility to assume the lead in the transition to the new standard. Qualified individuals should be given the responsibility and authority to facilitate the transition. The transition process should begin with a careful reading of SQCS 7, along with a review of the firm's existing policies and procedures. Quality control policies and procedures should then be developed, revised, or amended where necessary. Special care should be taken to ensure that procedures provide appropriate documentation of the operation of each element of quality control. The system of quality control should be documented and communicated to the firm's personnel.

One approach to making the transition to SQCS 7 from an already-documented system of quality control or to creating the initial documentation is the use of a practice aid. While such products are available through various vendors, two excellent products are available, free of charge, from the AICPA.

The AICPA audit and accounting practice aid, Establishing and Maintaining a System of Quality Control for a CPA Firm's Accounting and Auditing Practice (available at Control_Practice_Aid.pdf), has been revised to reflect SQCS 7. The Quality Control Standards Task Force prepared the practice aid, and the policies and procedures represent the views of the task force regarding best practices for a quality control system. Although the practice aid has no official or authoritative status, the AICPA Audit and Attest Standards staff has reviewed the publication. The practice aid includes illustrative cases of four hypothetical firms of varying size and structure implementing SQCS 7. Firms are encouraged to consider these cases in designing and maintaining an appropriate system of quality control.

A second alternative that will guide the transition to SQCS 7 and document the quality control system is the use one of the peer review program (PRP) questionnaires. In conjunction with having a system peer review, a firm is required to complete either form PRP section 4300 or 4400 to document its quality control system. Form 4400 is for firms with two or more personnel, whereas form 4300 is for a sole practitioner with no personnel. Both forms are based on SQCS 7 and incorporate the guidance from the above-mentioned AICPA practice aid.

Completing either form requires more than "yes" or "no" answers. A firm should provide comprehensive responses that describe its policies and procedures. An appropriate questionnaire completed in adequate detail can normally be used to comply with SQCS 7. The questionnaires, however, are not intended to be used as the quality control document for large firms with complex systems of quality of control. The peer review quality control questionnaires can be downloaded at no charge from the AICPA's website at

Where Do We Go from Here?

CPAs must frequently assist their clients in implementing changes in professional standards. SQCS 7 is a change in standards, but it is unique in that the standard relates exclusively to accounting firms, is mandatory, and requires evidence of not only the firm's implementation but also its continued compliance. Rather than viewing SQCS 7 as an imposition, CPA firms should embrace it as an opportunity to review and improve their internal policies and procedures.

James Schmutte, DBA, CPA, is a professor in the department of accounting at Ball State University, Muncie, Ind., and John Thieling, CPA, is with Thieling Co. LLC, CPA, Plymouth, Ind.
COPYRIGHT 2010 New York State Society of Certified Public Accountants
No portion of this article can be reproduced without the express written permission from the copyright holder.
Copyright 2010 Gale, Cengage Learning. All rights reserved.

Article Details
Printer friendly Cite/link Email Feedback
Title Annotation:practice management
Author:Schmutte, James; Thieling, John
Publication:The CPA Journal
Date:Jan 1, 2010
Previous Article:Overseeing investment managers: 10 lessons from the financial crisis.
Next Article:Is outsourced data secure?

Terms of use | Privacy policy | Copyright © 2018 Farlex, Inc. | Feedback | For webmasters