Preparing for an ICPAK quality review
How a Kenyan audit firm can prepare its licences, quality records and audit files for ICPAK's audit quality review, and what Achekam keeps for it.
By Achekam · · 5 min read · For Accountants & audit firms in Kenya
The letter announcing an audit quality review rarely arrives at a convenient time. In a Kenyan firm it tends to land in the middle of the busy season, and the partner's first reaction is to start hunting: for last year's licence renewals, for the quality manual nobody has opened since it was written, for the audit file whose working papers were finished "after the report, but only tidying".
Firms that come through a review well are not the ones that prepare hardest in the weeks before it. They are the ones whose records were in order all year. This article covers who reviews Kenyan audit firms, what standards the review measures you against, and how to keep licences, quality records and audit files ready to show at short notice.
ICPAK regulates and reviews
ICPAK, Kenya's professional accountancy institute, regulates accountants under the Accountants Act 2008. It issues practising certificates under section 21 and annual licences under section 22. Kenya has no independent audit oversight board, so ICPAK runs audit quality reviews itself.
That combination matters. The body that licenses you is also the body that looks at your work, so a weak review can have consequences for the licence as well as for reputation. IFAC's profile of ICPAK summarises the position: Kenya adopts the ISAs as issued by the IAASB, uses the IESBA Code and ISQM 1 and 2, and ICPAK runs the audit quality reviews.
The standards the review applies
Kenya applies the IAASB's International Standards on Auditing as issued, with ISQM 1 and ISQM 2, and key audit matters are required for listed entities. Expect a reviewer to look at two levels:
- The firm: your system of quality management under ISQM 1, including how you identified quality risks, how you respond to them and how you monitor the system.
- The engagement: selected audit files, tested against the ISAs, including evidence, documentation, the auditor's report and, for listed clients, key audit matters.
One standard you will not be using: Achekam refuses the ISA for Less Complex Entities on Kenyan audits because no ICPAK adoption of it was found. If a reviewer asks why a small audit followed the full ISAs, that is the reason, and it is worth a line in your methodology.
On each Kenyan engagement, Achekam shows an Audit Control Tower covering entity classification, whether company law requires an audit, an acceptance checklist, regulatory confirmations and sector checklists, and it works out whether key audit matters are required. The acceptance checklist must be approved by a partner other than its preparer before the audit report can be approved. Those approvals are the kind of evidence a reviewer looks for on acceptance and continuance.
Practising certificates and licences on file
Under the Companies Act 2015, section 772, a statutory auditor, or each partner of an audit firm, must hold an ICPAK practising certificate and a valid annual licence. Section 773 bars an ineligible auditor, and section 774 deals with independence.
A reviewer will want to see that the people who signed reports were eligible on the day they signed. Achekam supports this in two ways:
- Staff record the firm's ICPAK licence and each signing professional's registration, and a different person must verify each one against the official register with dated evidence. Achekam does not look these up online; its "check online" call always answers unavailable, so the check is a person's job.
- For a Kenyan firm, Achekam blocks signing until the signing partner's practising certificate and annual licence are verified as valid on the signing date. A missing firm-licence check gives only a warning, so keep the firm licence current yourself.
Keep the dated evidence, such as a saved copy of the register entry, with the verification. That evidence is what shows eligibility at the date of each report. The ICPAK certificate block on signing explains the signing control in detail.
Quality records with their versions
ISQM 1 expects documented quality objectives, risks and responses, and evidence that the system was monitored and deficiencies remediated. Achekam keeps the firm's quality registers on its server, among them professional judgements, quality incidents, complaints and inspection progress, with every version and who changed it.
Versions are the point. A reviewer reading an incident log wants to see what you knew when, not only the tidy final entry. One caution: sign-off roles on professional judgements are checked only by the screen, not by the server, so look over who signed off each judgement as part of your own monitoring.
If your firm is still building its system of quality management, setting up ISQM 1 in a small firm suggests a practical order of work.
Files that show who signed and when
A file a reviewer can follow is one that was closed properly. After the report is issued, the engagement partner assembles and locks the audit file in Achekam. From then on, changes can only be added as addenda, and unlocking needs a second partner or the quality reviewer.
Each locked file is built into an archive of its papers, workbooks, signed report and logs, with a hash manifest that can be re-verified. Anything that could not be included is listed as an omission. Only a partner, a manager or the quality reviewer can download it. Before the review, download the archives for the files likely to be selected and confirm that each one verifies and that its omissions list is empty or explained. Assembling and archiving the audit file covers the locking steps.
A readiness checklist
- Current practising certificates and annual licences for every signing partner, each verified with dated evidence.
- The firm licence renewed and recorded.
- The quality manual, quality objectives and risk assessment, with the date each was last reviewed.
- The quality registers up to date, including last year's findings and what was done about them.
- Audit files locked after issue, with archives that verify.
- Acceptance checklists approved by a second partner on every Kenyan audit.
Work through the list once now, when nothing is due, and again each quarter. A review then becomes a matter of opening records rather than creating them.
General guidance only, not advice on your own circumstances. Tax and payroll rules change: check the current position with the authority or your adviser.
