From ISQC 1 to ISQM 1: what changed
What changed when ISQM 1 replaced ISQC 1, and what a firm still working from an old quality control manual needs to do to catch up.
By Achekam · · 4 min read · For Accountants & audit firms in South Africa, Nigeria, Kenya
Somewhere in many smaller practices there is a quality control manual written years ago, revised once, and kept in a shared folder. It lists policies, attaches forms and is updated when an inspector asks for something. It was built for ISQC 1. Those firms may still be running on it.
ISQM 1 did not just add requirements to that manual. It changed what the manual is for. A firm that has renamed its old document without rethinking it has a system of quality control wearing a new label, and that gap tends to show at inspection or when something goes wrong on a file.
From quality control to quality management
ISQM 1 replaces ISQC 1, Quality Control for Firms that Perform Audits and Reviews of Financial Statements and Other Assurance and Related Services Engagements. The change of word in the title, from control to management, is the heart of it.
The IAASB states that ISQM 1 strengthens firms' systems of quality management through a robust, proactive and effective approach. In practice, the shift is from following a fixed set of policies to running a system that identifies its own quality risks and responds to them. Under the old approach, a firm could comply by having the right policies on paper. Under the new one, the firm is expected to know what could go wrong in its own practice and to show how its system deals with it.
A system shaped around the firm
ISQM 1 encourages firms to design a system tailored to the nature and circumstances of the firm and the engagements it performs. That matters for small and medium practices. A two-partner firm doing mostly independent reviews and a handful of audits does not need the system of a large network. It does need one that reflects its actual risks: perhaps limited capacity in the busy season, reliance on one technical partner, or a concentration of clients in one sector.
The IAASB's ISQM 1 page is the place to read the standard and its supporting guidance.
The December 2022 date
The IAASB states that firms were required to have systems of quality management designed and implemented in accordance with ISQM 1 by 15 December 2022. That date has passed. A firm still relying on an ISQC 1 manual is not in transition; it is behind.
Two companions: ISQM 2 and ISA 220 (Revised)
ACCA lists the current IAASB quality standards as ISQM 1, Quality Management for Firms that Perform Audits or Reviews of Financial Statements; ISQM 2, Engagement Quality Reviews; and ISA 220 (Revised), Quality Management for an Audit of Financial Statements.
The three work together. ISQM 1 sets the firm-level system. ISQM 2 deals with engagement quality reviews. ISA 220 (Revised) deals with quality management on each individual audit. A firm updating its approach should look at all three together, not ISQM 1 alone.
Moving off the old manual
The practical work of moving from a manual to a system often involves two things: where the firm's quality records live, and how its methodology is controlled.
Registers. Achekam keeps a firm's quality registers, such as professional judgements, quality incidents, complaints and inspection progress, on the server with every version and who changed it. That gives the firm a living record rather than a static manual, which suits a system that is supposed to respond to what it finds. One limit to know: sign-off roles on professional judgements are checked only by the screen, not by the server, so the firm's own review should confirm the right people signed.
Methodology. A firm's partners can keep their own methodology and working-paper templates in Achekam beside its platform methodology, which they can adopt. A template version is published only by someone other than its author. For a firm that used to update its manual informally, that separation between author and publisher is a straightforward control over changes to how engagements are performed.
Signs a system is still ISQC 1 in disguise
Ask these questions about the firm's current approach:
- Is there a documented quality risk assessment specific to this firm, or only a list of policies?
- Do quality objectives come first, with policies as responses, or are policies the starting point?
- Has the system changed in response to anything found in monitoring, inspections or complaints in the past year?
- Is a named leader accountable for the system as a whole?
- Is there an annual evaluation of whether the system is achieving its objectives?
- Are engagement quality reviews decided by a documented policy covering which engagements need one?
- Does the manual still refer to ISQC 1?
Any "no" or "not sure" is a place to start.
Setting quality objectives is the first step in moving from a policy list to a working system, and ISQM 1 quality objectives explains how. Monitoring is where the new system proves itself, and cold file reviews are a practical way for a smaller firm to start. Open the firm's quality manual this week, search for "ISQC", and treat every hit as a task.
General guidance only, not advice on your own circumstances. Tax and payroll rules change: check the current position with the authority or your adviser.
