Does an independent review need a quality review?
When an independent review engagement should have an engagement quality review under the firm's ISQM 1 policy, and how to set one up and scale it.
By Achekam · · 4 min read · For Accountants & audit firms in South Africa, Nigeria, Kenya
Engagement quality reviews are usually discussed in the language of audits: listed companies, public interest entities, significant judgements in complex audits. Firms whose work is mostly independent reviews of owner-managed companies, trusts and non-profits can be forgiven for assuming the topic does not apply to them.
It can. The standards on engagement quality reviews cover reviews of financial statements as well as audits, and a firm's own policy decides which of its review engagements get one. For a practice built on review work, that policy is one of the more important quality decisions it makes.
ISQM 2 reaches reviews as well
The IAASB's ISQM 2 page states that ISQM 2 is effective for audits and reviews of financial statements for periods beginning on or after 15 December 2022. It applies to all engagements for which an engagement quality review is required to be performed in accordance with ISQM 1.
So ISQM 2 does not itself decide which engagements need a review. It sets out how the review is done and who may do it. The decision about which engagements need one sits with ISQM 1 and with the firm.
The engagements in question here are those under ISRE 2400 (Revised), Engagements to Review Historical Financial Statements, which deals with the practitioner's responsibilities when engaged to review historical financial statements and the practitioner is not the entity's auditor.
When the firm's policy should require one
ACCA explains that ISQM 1 requires an engagement quality review in three situations:
- audits of listed companies;
- audits and other engagements where a review is required by law or regulation;
- audits or other engagements where the firm determines that a review is an appropriate response to one or more quality risks.
ACCA's examples of the third category include complex or high-judgement audits, audits with significant issues such as a material restatement, and engagements for which the firm has no prior experience. ACCA's article also carries a note worth heeding: the IAASB's 2026 Handbook page states that narrow scope amendments arising from the revised definitions of listed and public interest entities in the IESBA Code become effective in December 2026, so check the amended scope before relying on the "listed companies" wording.
For a review practice, the first category rarely applies, and the second depends on local law or a regulator. The third is where the firm's judgement matters. "Other engagements" includes reviews.
Risk factors in review engagements
When designing the policy, consider which review engagements carry quality risks that a second, objective look would address:
- Significant judgements in the statements, such as going concern doubts, large estimates or unusual revenue arrangements.
- Users who rely heavily on the statements: lenders, funders, a regulator or a large membership.
- New or unfamiliar sectors for the firm.
- A modified conclusion being considered.
- A history of problems with the client, such as late information or disputes over adjustments.
- The firm's own circumstances, for example a partner new to review work or a heavy season.
The policy can name categories that always get a review and leave room for an engagement partner to request one where risks arise during the work.
Setting it up in Achekam
When creating an engagement in Achekam, staff choose its type, such as annual financial statements compilation, independent review or statutory audit, and a firm can add its own named types. A firm that wants to separate higher-risk reviews could, for example, add a named type for them, which makes it easier to see across the client list which engagements fall under the quality review policy.
A partner can name an engagement quality reviewer for an engagement, who must be a partner or senior manager not on the engagement team. For a South African firm, Achekam does not require a reviewer for any engagement type; naming one is the firm's decision.
One detail to plan around: the clearance step described in Achekam is that the reviewer must clear the audit report before it can be issued. For a review engagement, make the reviewer's sign-off on the review report a step in the firm's own procedure, recorded on the file, and confirm it has happened before the report goes to the client.
Scaling the review to the engagement
The reviewer evaluates the team's significant judgements and the conclusions reached on them. On an independent review, that usually means:
- the team's understanding of the entity and the areas it identified as likely to contain material misstatement;
- the inquiry and analytical procedures performed on those areas and what they showed;
- significant matters discussed with management and how they were resolved;
- whether the proposed conclusion and report wording fit the evidence.
On a straightforward review, that may be a focused read of the key working papers and a conversation with the engagement partner. On a complex one, it will take longer. Review procedures under ISRE 2400 describes the work the reviewer is evaluating.
Recording the policy decision
Whatever the firm decides, write it down: which review engagements require a quality review, who may act as reviewer, when the review must be completed, and how it is documented. Record the decision for each engagement at planning, including where the firm decided a review was not needed and why.
For the broader decision across all engagement types, see which engagements need an EQR. At the next quality meeting, list the firm's three highest-risk review clients and ask whether each would benefit from a second partner's look before the report is signed.
General guidance only, not advice on your own circumstances. Tax and payroll rules change: check the current position with the authority or your adviser.
