Setting up ISQM 1 in a small firm
How a small firm sets quality objectives, identifies quality risks and designs responses under ISQM 1, and which records Achekam can keep.
By Achekam · · 4 min read · For Accountants & audit firms in South Africa, Nigeria, Kenya
Many small firms met ISQM 1 by buying a quality manual, changing the firm name on the cover and filing it. That approach worked for the old standard, which was largely a list of required policies. It does not work for ISQM 1, which asks a firm to think about its own risks and build responses that fit them.
The good news for a small firm is that "fit" cuts both ways. A two-partner practice does not need the machinery of a large network. It needs a system it actually runs, written down in proportion to its size, with evidence that it works. This article goes through the steps and points out which records Achekam can hold for you.
A risk-based system, not a manual on a shelf
ISQM 1 applies to firms that perform audits or reviews of financial statements, or other assurance or related services engagements. In South Africa, IRBA regulates auditors and its auditing standards follow the IAASB's. Nigeria applies the ISAs as issued, with ISQM 1 and ISQM 2 from 15 December 2022. Kenya applies the ISAs as issued, with ISQM 1 and ISQM 2.
The standard's logic runs in a chain: set quality objectives, identify what could stop the firm achieving them, design responses, monitor whether they work, fix what does not. The firm's leadership owns the chain, and one person is assigned ultimate responsibility for the system.
The components and the quality objectives
ISQM 1 organises the system into eight components: the firm's risk assessment process; governance and leadership; relevant ethical requirements; acceptance and continuance; engagement performance; resources; information and communication; and monitoring and remediation. The standard sets quality objectives for most of them, and the firm may add its own.
For a small firm, the fastest route is to start from the standard's objectives rather than inventing new ones, and to spend the effort on the next step.
Quality risks specific to a small firm
A quality risk is something that could plausibly happen and would stop an objective being met. Generic risks lead to generic responses, so write them in terms of your own practice. Some examples that often apply to small firms:
| Component | A small-firm quality risk | A possible response |
|---|---|---|
| Ethical requirements | Long association with family-owned clients goes unnoticed | Annual declarations, with a partner reading each one |
| Acceptance and continuance | A client is taken on for the fee without a conflict check | Acceptance review approved by a partner before the engagement letter |
| Engagement performance | One partner both performs and reviews the hardest areas | Pre-issuance review by an outside practitioner for listed criteria |
| Resources | Methodology templates drift out of date | Template changes approved by someone other than their author |
| Monitoring | Nobody looks at completed files | Cold file reviews on a cycle, recorded with findings |
The IFAC quality management toolkit for small and medium-sized firms includes illustrative policies, checklists and forms, together with a risk matrix, and is a sensible place to start drafting your own list.
Responses and who owns them
Each response needs an owner and some evidence that it operates. Several of the responses above can run inside Achekam:
- Acceptance. A firm can record a client acceptance review after a conflict check against its own clients and contacts, and only a signed-in partner can approve it. Customer due diligence there is a tick-box confirmation by the preparer, and Achekam runs no automatic FICA, CIPC or sanctions check.
- Ethics. Staff record annual independence declarations and any interest, relationship or gift involving a client. Achekam cannot yet approve a declaration, and assigning someone to an engagement does not check the register, so a partner's review of declarations stays a manual step. Independence declarations today covers the gap.
- Methodology. A firm's partners keep their own methodology and working-paper templates, and a template version is published only by someone other than its author.
- Consultation. Staff take a technical consultation from question to conclusion and closure, and record differences of opinion with each party's position and resolution.
- Statutory rules. Partners and administrators can read the approved statutory rules Achekam's decisions use, such as public interest score thresholds and audit-file retention, with their change log. Only Achekam's platform administrators change them, never one person alone.
Keeping registers with every version
The firm's quality registers, among them professional judgements, quality incidents, complaints and inspection progress, are kept on Achekam's server with every version and who changed it. That history is what lets you show an inspector how the system evolved, not just its current state. The registers and their limits are described in quality registers, consultations and disagreements.
Two things Achekam does not do for you. Sign-off roles on professional judgements are checked only by the screen, not the server. And the Partner Quality Intervention Centre, badged "ISQM 1 / AQI", has no screen that records an indicator value or opens an intervention. Keep the risk assessment itself, the list of objectives, risks and responses, in a document or workbook you control.
The annual evaluation
At least once a year, the person with ultimate responsibility evaluates whether the system gives reasonable assurance that its objectives are met. In a small firm this can be a short written conclusion, supported by:
- the results of monitoring, including cold file reviews and any inspection;
- the deficiencies found, their causes and what was done, using a root cause analysis for anything significant;
- changes in the firm or its clients that should change the risk assessment.
Date it, sign it and keep it with the registers.
A first month
Week one, list the objectives. Week two, write the risks in your own words. Week three, match each risk to a response and an owner. Week four, decide where the evidence for each response will live, and move the registers you already keep into one place.
General guidance only, not advice on your own circumstances. Tax and payroll rules change: check the current position with the authority or your adviser.
