Preparing for ICAN's practice monitoring review
What ICAN's Professional Practice Department checks when it monitors a Nigerian practice firm, and a self-review to run before the visit.
By Achekam · · 5 min read · For Accountants & audit firms in Nigeria
The letter from ICAN announcing a monitoring visit usually lands when the firm is busiest. Partners scramble to find last year's audit files, someone asks whether the independence forms were ever collected, and a manager discovers that two trainees were never registered. The visit itself may go well enough, but the week before it is miserable.
It does not need to be. A monitoring review tests things a well-run firm already does. The work is to know what the reviewers look at, keep the evidence where it can be found, and test yourself before they arrive.
What ICAN reviews and against what
The Institute of Chartered Accountants of Nigeria runs a Professional Practice Monitoring Exercise through its Professional Practice Department. According to ICAN, the department reviews members' practice firms to check whether they comply with the auditing standards, the Professional Code of Conduct and Guides for Members, the laws and other relevant regulations.
That is a broad brief. It covers the quality of individual audit files, the firm's ethical conduct, and its adherence to the law that governs auditors and the businesses they audit. ICAN's Professional Practice Department page describes the monitoring exercise alongside the department's other work for members in practice, including trainee registration and practice licensing.
On the auditing standards themselves, IFAC's profile of Nigeria records the International Standards on Auditing as adopted in their entirety for all mandatory audits in Nigeria. That includes the ISA for Less Complex Entities, which the FRC adopted by public notice in 2025. A reviewer can therefore expect the firm's audit files to show the ISAs, or the ISA for LCE where the firm has chosen it for a suitable client, applied in full. How the two sets of standards sit together in Nigeria and Kenya is explained in auditing and quality standards in both countries.
ISQM 1 and ISQM 2 in Nigeria
Quality management has moved on from the old quality control standard. IFAC's Nigeria profile says ISQM 1 and ISQM 2 are applicable and effective in Nigeria for firms performing audits and reviews of financial statements and other assurance engagements.
The same profile assesses the country's quality assurance framework overall as only partially adopted, because the FRC's inspection regime for public interest entities is not yet fully operational. That is a comment on the regulator's arrangements, not a relaxation for firms. A firm that performs audits should be able to show a reviewer its system of quality management under ISQM 1: its quality objectives, the risks to them, the responses, and how it monitors whether the system works. Where the firm performs engagement quality reviews, ISQM 2 governs who performs them and how. If the firm's quality objectives are still a draft, setting ISQM 1 quality objectives is the place to start.
Registered trainees
ICAN states that all audit trainees, both Qualified Audit Trainees and Student Audit Trainees, must be registered with the Institute. Because the same department oversees trainee registration and practice monitoring, a reviewer may well ask for the list of trainees and their registration status.
Before the visit, reconcile the firm's staff list with ICAN's registration records. Anyone working as an audit trainee who is not registered should be registered now, and the reason for the gap noted honestly.
Audit files that cannot be quietly changed
A reviewer who opens a completed audit file wants confidence that what they see is what the firm had when it signed the report. Files that were tidied up afterwards undermine that confidence, however innocent the tidying.
In Achekam, once the auditor's report is issued, the engagement partner assembles and locks the audit file. After that, changes can only be added as addenda, and unlocking the file needs a second partner or the quality reviewer. Some conditions cannot be overridden at all: a file cannot be locked over an unissued report, an uncleared quality review or a missing retention rule.
For a monitoring visit this gives the firm a simple answer to an awkward question. When a reviewer asks whether a paper was added after sign-off, the addendum record shows what was added and when, and the locked file shows what existed at the time.
Quality registers and independence
The Professional Code of Conduct and ISQM 1 both expect evidence, not assurances. Two sets of records carry most of it.
Quality registers. Achekam keeps the firm's quality registers on the server: professional judgements, quality incidents, complaints and inspection progress, each with every version and the person who changed it. One limit to know: sign-off roles on professional judgements are checked only by the screen, not by the server, so the firm's own review of the register should confirm that the right people signed.
Independence. Staff record annual independence declarations, and any interest, relationship or gift involving a client. Anyone can check whether a person has an active independence exception for a client. Before a visit, confirm that every person who worked on an audit in the period has a current declaration on record.
A self-review before the visit
Run this review a month or so before the expected visit, or annually if no visit is scheduled:
- Standards. Pick a sample of completed audit files and check them against the ISAs, or the ISA for LCE where used. Note any gap and fix the methodology, not just the file.
- Quality management. Confirm the ISQM 1 documentation is current and that monitoring findings from last year were acted on.
- Engagement quality reviews. For each engagement that needed one, check that the reviewer met ISQM 2's eligibility requirements and that the review was completed before the report date.
- Files. Confirm every issued audit has a locked file and that any later additions are addenda.
- Registers. Read the quality incident and complaints registers. Has each item been closed or escalated?
- Independence. Match the list of staff on audits to the declarations on record.
- Trainees. Reconcile trainees to ICAN registrations.
- Laws and regulations. List the laws that govern the firm's practice and its clients' audits, and check the files show they were considered.
Write the results up as a short internal report, record the actions in the inspection progress register, and give the reviewers a copy if they ask what the firm does to monitor itself.
Do not wait for the notice. Schedule the self-review now, assign each of the eight areas to a named partner or manager, and record the findings in the firm's quality registers so that the next visit starts from evidence rather than a scramble.
General guidance only, not advice on your own circumstances. Tax and payroll rules change: check the current position with the authority or your adviser.
