AOF – Chapter 3: Quality control in audit and assurance service

LECTURE 3: QUALITY CONTROL IN AUDIT AND ASSURANCE SERVICE

3.1. The need for quality standards

Definition of quality control

“Quality controls are policies and procedures adopted by Certified Public

Accountants (CPAs) to provide reasonable assurance of conforming to professional
standards in performing audit and related services”.

* What could go wrong?

There are lots of reasons which affect to the reliability of information. An engagement
could go wrong due to client-based problems or assurance firm-based problems, for
example that the engagement team has insufficient knowledge of the business or are
badly directed and supervised. The detail reasons are as following:
 AOF – Chapter 3: Quality control in audit and assurance service

The reasons are due to:

4. The supervisor
3. The engagement partner - May not have
- May have insufficient knowledge adequate
of the client and its environment understanding of the
2. The individual - May fail to pass knowledge of the client’s business
auditor business on to the audit team - May not brief and
- May not have - May select the wrong team for the direct the staff
adequate audit properly
1. The client - May not carry out
understanding of - May not adequately brief and
- Could be sufficient supervision
the client’s supervise the team
incompetent so that the wrong
business - May not consult sufficiently with
- Could be work is done by the
- May not perform colleagues and outside experts
negligent audit team
the right work to - May not review the work carried
- May - May fail to deal
an adequate out by the team with sufficient care
mislead the with issues raised
standard - May fail to deal with issues raised
audit team adequately
- May not record adequately.
the work done - May not draw the correct - May fail to
adequately. conclusions from the evidence communicate the
available. issues arising to the
engagement partner.

The quality control not only help to reduce the assurance engagement risk but also
help auditors perform the working steps and audit procedures adequately from that help
to reduce audit risk as well as increase the believes of audited information users.
AOF – Chapter 3: Quality control in audit and assurance service

Purposes of quality control

The audit firms need to perform the quality control for following purposes:
1. Provide reasonable assurance that:
- Work complies with professional standards and regulatory and legal
requirements.
- Compliance with the firm’s own procedures.
- Assurance reports are appropriate in the circumstances.
2. Protect auditor in case of future litigation and or disciplinary investigations.

Quality control procedures

To control quality, the audit firms need to perform the following procedures:
1. Perform engagement quality control review for all listed companies and
companies that is considered high risks.
2. Recruit employees who have competence, knowledge, experience, and skills.
3. Consider training more to staff.
4. All work performed must be review by a higher-level staff, communicating
when have significant problems and documents all the communication.
5. Allocate experienced and competent staff to the engagement.
6. Undertake due diligence process, including assessment of management's
integrity, prior to accepting new clients and deciding whether to continue with
existing clients.

* The consequence of quality failure

If the audit does not guarantee quality, the auditors and audit firm will be fined or be
suspended for carrying out audits or be bankrupted.

For example: Arthur Andersen was bankrupted because of the consequence of quality
failure. It was very catastrophic.

To reduce the risk of the wrong opinion, it is necessary to have internal and external
systems of quality control. When implement the audit and assurance services, auditors
and audit firms must comply with regulations of ISQC 1 “Quality control for firms that
perform audits and reviews of financial statements and other assurance and related
services engagements” and ISA 220 “Quality control for an audit of financial
AOF – Chapter 3: Quality control in audit and assurance service

statements”.

Approach to quality control

To reduce the assurance engagement risk to an acceptable level, the audit firms need
to design and operate:
1. Procedures for ensuring only suitable clients are taken on.
2. Procedures for ensuring only suitable clients are retained.
3. Procedures for ensuring that the firm’s partner and staff have the necessary
knowledge and competence.
4. Guidance on ethics
5. Communication skills
6. Briefing and supervision skills
7. Professional skepticism and judgement
8. Monitoring.
According to ISQC 1, there are six main elements of a firm’s quality control
system as follow: (HALEEM)
1. Leadership responsibilities for quality within the firm
Strong and ethical leadership demonstrated by the managing partners.
2. Ethical requirements
Firms comply with ethical requirement such as the Code of ethics.
3. Acceptance and continuance of client relationships and specific engagements
Only suitable clients and engagements are accepted and retained.
4. Human resources
A firm and its employees have the necessary knowledges, technical
competence and relevant experiences.
5. Engagement performance
Engagements need to be performed in an effective manner. An audit firm have
to make sure that they come up with the mechanism where they need to ensure
the engagements are performed in the timely basis and effective way. Audit
firms need to come up with proper direction, supervision, and review to get
the highest of quality level.
6. Monitoring.
AOF – Chapter 3: Quality control in audit and assurance service

Evaluating the quality control procedures to ensure they are effective.

Audit firm shall perform hot review or cold review in specific circumstances.

ISQC 1 also requires that the firm documents its policies and procedures and
communicates them to the firm’s personnel. Procedures should depend on such things
as the size of the firm, the number of practice offices, and the nature of the practice.

3.2. Leadership

The ISQC (UK) points out the importance of quality being an established part of the
culture of the firm. Therefore, the audit firm should promote a culture that quality is
essential in performing engagements and should establish policies and procedures that
support that culture.

In practical terms, the people directing the firm and its resources should ensure that:

- Commercial considerations do not override the quality of work performed.

- The firm’s policies in relation to staff promotion, remuneration and
performance review incorporate the importance of quality work.
- Sufficient resources are allocated to the development, documentation and
support of quality control policies and procedures.
Example of policies and procedures:
1. The firm’s training programs emphasize the importance of quality work, and
this is importance of quality work, and this is reinforced in performance
evaluation and compensation decisions.
2. Such policies and procedures shall require the firm’s manager or director (or
equivalent) or, if appropriate, the firm’s partners to assume ultimate
responsibility for the firm’s systems of quality control.
3. The audit firm builds and operates the reward and discipline policy for
achieving audit quality.

3.3. Ethics

The firm shall establish policies and procedures designed to provide it with
reasonable assurance that the firm and its personnel comply with relevant ethical
requirements.

All auditors who implement the engagement should maintain independent in fact
AOF – Chapter 3: Quality control in audit and assurance service

and in appearance, perform all professional responsibilities with integrity, and maintain
objectivity in performing their responsibilities.

Example of policies and procedures:

1. All engagement members (including partner, team leader, auditors, and auditor
assistants) must answer independence questionnaire and complete
independent checking procedures before participating in auditing.

2. Identify and evaluate circumstances and relationships that create threats to

independence, and to take appropriate action to eliminate those threats or reduce
them to an acceptable level by applying safeguards or withdraw from the
engagement.

3.4. Acceptance of engagements

The firm should design policies and procedures to ensure that only appropriate
clients are accepted in the first place and retained.

The policies and procedures should minimize the risk of associating with a client
whose management lacks integrity. Besides, the firm should also only undertake
engagements that can be completed with professional competence.

Example of policies and procedures:

(1) Inquiry the board of management and related personnel of audit entity directly
to collect information about integrity of management.
(2) Contact with predecessor auditor to collect information and assess the
integrity of audited entity’s management.

3.5. Human resources

Quality of human resources plays an important role in the audit firm’s action. So,
the audit firm should have policies and procedures to ensure that it employs and retains
staff with the capabilities, competence and commitment to ethical principles necessary
to:

i. perform the engagements accordance with professional standards and

regulatory and legal requirements; and
ii. enable engagement partner to issue reports that are appropriate in the
AOF – Chapter 3: Quality control in audit and assurance service

circumstances.

To employ and retain staffs who have suitable knowledge and skill, the audit firm
should have policies on recruitment, career development, performance evaluation
and promotion.

According to ISQC (UK), the audit firm should have policies on all aspects of
employing professional staff as follows:

- Recruitment
- Performance evaluation
- Capabilities
- Competence
- Career development
- Promotion
- Compensation
- The estimation of personnel needs (for instance, self- appraisal as well as
appraisal by others).

After having the sufficient and appropriate human resources, the audit firm needs to
allocate staff to assurance engagements appropriately. Firms are required to have policies
to ensure that:

1. Clients are informed of the identity and role of the engagement partner.
2. The engagement partner has the capabilities, competence, authority, and time
to perform the role.
3. The responsibilities of the partner in respect of the engagement are clearly
defined and communicated to that partner.

3.6. Engagement performance

The audit firm shall establish policies and procedures designed to provide it with
reasonable assurance that engagements are performed in accordance with professional
standards and regulatory and legal requirements.
Example of policies and procedures:
The firm’s director of accounting and auditing is available for consultation and
must approve all engagements before their completion.
AOF – Chapter 3: Quality control in audit and assurance service

* Quality control in engagement performance phase is to implement the following

actions: direction, supervision, review, documentation and review, consultation.
* Direction
The engagement partner has main responsibility in the direction of engagement
performance, but this duty will be delegated to the most senior team member on site
at the engagement. In fact, the most senior team member will direct the engagement in
accordance with the overall strategy. The engagement partner is responsible for:
1. What work they are supposed to be doing.
2. The nature of the entity’s business.
3. Any risks relevant to the engagement.
4. Problems that might arise during the engagement.
5. The detailed approach to the engagement.
* Supervision
The partner has overall responsibility for supervising the audit but in fact the
partner will normally delegate supervisory duties to a manager or team leader who
is responsible for the day- to –day management of the engagement.
According to ISA 220, there are 4 features of supervision as follow:
1. Progress tracking
2. Considering the competence and capabilities of individual members of the
audit team
3. Addressing significant matters arising during the audit
4. Identifying matters for consultation or consideration by more experienced
engagement team members during the audit engagement.
* Review
Normally, the review of staff’s performed working is performed by team leader,
manager/director, and engagement partner. The review is the obligatory procedure
according to law and regulations. Besides, the review will help to assess the sufficiency
and appropriateness of obtained audit evidence.
The purpose of the review is to consider whether:
1. The work done is in line with the audit strategy.
2. The work has been performed in accordance with professional standards and
regulatory and legal requirements.
AOF – Chapter 3: Quality control in audit and assurance service

3. Significant matters have been raised for further consideration.

4. There is a need to revise the nature, timing and extent of work performed.
5. The evidence obtained is sufficient and appropriate to support the report.
6. The objectives of the engagement procedures have been achieved, etc.

After reviewing, the engagement partner must be satisfied that sufficient and
appropriate audit evidence has been obtained to support the conclusions in the auditor’s
report. Relating to audit engagement, it is very necessary to review the engagement quality
control (EQCR). This review is performed by a suitably qualified partner or other person in
the firm not otherwise involved in the engagement or by an external consultant. This is called
“independent review”. This review will provide an additional safety check about the
validity of the firm’s opinion on the financial statements.

Besides, the audit firm can perform a ‘hot’ review relating to audit engagement. A hot
review is a review carried out by a partner not otherwise involved in the engagement or an
external consultant before the auditor’s report is signed. However, it is not necessarily the
same as an engagement quality control review.

* Documentation and review

At the audit firm, the review of working papers and auditing file are often
performed by team leader, manager/director, and engagement partner.
The documentation of audit procedures will help to enable the reviews described
earlier to be carried out. Adequate documentation is also essential to allow the firm to
implement overall monitoring of quality.
*Consultation
If auditors meet the difficult or contentious issues, they must consult properly on the
matter and must be properly recorded the result of consultation. The assurance team
needs to receive the consultation from independent person with the audit engagement.
The firm should establish policies and procedures designed to provide it with
reasonable assurance that:
1. Appropriate consultation takes place on difficult or contentious matters.
2. Sufficient resources are available to enable appropriate consultation to take
place.
3. Conclusions resulting from consultation are implemented.
AOF – Chapter 3: Quality control in audit and assurance service

3.7. Monitoring

The audit firm shall establish monitoring process designed to provide it with
reasonable assurance that the policies and procedures relating to system of quality
control are relevant, adequate, and operating effectively. The audit firm shall document
policies and procedures and communicate them to the firm’s personnel. The compliance
or quality department should be established to carries out such reviews.

The partners in the audit firm should receive at least an annual report of the results
of monitoring of quality control procedures. Key issues will be systematic or
repetitive deficiencies that require corrective action.

Example of procedures: The quality control partner must test the quality control
procedures at least annually to ensure the firm is in compliance.

* The difference between ‘hot review’ and ‘cold review’

Hot review Cold review

A hot review is a review carried out by Cold reviews are designed to be a

a partner not otherwise involved in the continuing part of the quality control
engagement or an external consultant process and take place after the assurance
before the auditor’s report is signed. assignment has been completed.

Cold reviews are usually conducted in one of the following ways:

1. As a process, whereby partners in a firm review each other’s work.

2. By a team specifically constituted to conduct such reviews- usually under the
direction of a partner, but the work is usually carried out by suitably qualified
and experienced managers.
3. By a suitably qualified external consultant.
 AOF – Chapter 3: Quality control in audit and assurance service

4.
* Purposes of engagement quality control review (EQCR) and Cold review
Purposes of EQCR Purposes of cold review

- Review of judgemental areas and - Compliance with IFRS,

how it was resolved. UK GAAP, ISA.

- Appropriateness of the opinion - Identify systemic

based on the evidence. deficiencies.

- Consultations have taken place - Take remedial actions.

* Actions if cold review detected a deficiency

- Communicate findings to staff involved.

- Evaluate the appropriateness of the report issued.
- If inappropriate, seek legal advice.
- Consider additional training.
- Consider amending the nature, extent, and timing of the engagement.
- Disciplinary actions
AOF – Chapter 3: Quality control in audit and assurance service

ACTIVITIES
MCQs
1. ISA 220 Quality Control for an Audit of Financial Statements requires the firm to
establish a system of quality control to ensure the firm complies with professional
standards and issues reports that are appropriate in the circumstances
A. The above statement is correct
B. The above statement is incorrect
2. For Quality Control for an Audit of Financial Statements Policies and procedures
should be established which address:

A. Leadership responsibilities for quality within the firm

B. Relevant ethical requirements
C. Acceptance and continuance of client relationships and specific
engagements
D. Human resources, Engagement performance, Monitoring.
E. All of the above

3. The engagement partner should ensure that the engagement team collectively
have the competence and capabilities to perform the audit in accordance with
professional standards. This includes:

A. knowledge of professional standards

B. knowledge of relevant industries in which the client operates
C. the ability to apply judgment and an understanding of the firm’s quality
control policies and procedures.
D. All of the above

4. Engagement performance comprises direction, supervision, consultant,

documentation and review of the engagement.

A. True
B. False

5. Engagement performance “direction” involves informing team members of:

A. Their responsibilities, Objectives of the work to be performed

B. The nature of the business, Risks
C. Problems that may arise, The detailed approach to the performance of
the engagement.
D. All of the above

6. Engagement performance “Supervision” includes:

A. Tracking the progress of the audit to ensure the timetable can be met
AOF – Chapter 3: Quality control in audit and assurance service

B. Considering the competence of the team

C. Addressing significant matters arising and modifying the planned
approach accordingly
D. All of the above

7. Engagement performance “Review” responsibilities include consideration of

whether:

A. The work has been performed in accordance with professional standards

B. Appropriate consultations have taken place
C. The work performed supports the conclusions reached
D. All of the above

8. Listed entities and other high-risk clients should be subject to an engagement

quality control review.

A. True
B. False

9. Engagement Quality Control Review (EQCR) includes:

A. Discussion of significant matters with the engagement partner.

B. Review of the financial statements and proposed auditor’s report.
C. Evaluation of conclusions reached in forming the audit opinion.
D. All of the above

4. Which of the following statements is false relating to review actions in the audit
firm?
A. The review will help to assess the sufficiency and appropriateness of obtained audit
evidence.
B. The review is an obligatory procedure according to law and regulations.
C. Engagement quality control review (EQCR) is performed by engagement partner.
D. A ‘hot review’ is a review carried out by a partner not otherwise involved in the
engagement or an external consultant.

5. Which of the following statements are true relating to review actions in the audit firm?
E. A ‘hot review’ is a review carried out by an independent partner after the auditor’s
report is signed.
F. Engagement quality control review (EQCR) is performed by a suitably qualified
partner who is NOT involved in the engagement.
G. The review is NOT an obligatory procedure according to law and regulations.
AOF – Chapter 3: Quality control in audit and assurance service

H. The review will help to assess the sufficiency and appropriateness of obtained
audit evidence.

6. Which THREE of the following procedures should be carried out after the audit
firm has decided to accept nomination as auditor?
A. Ensure that the new auditors ’appointment is valid.
B. Communicate with the outgoing auditors to discover any reasons they should not
accept appointments.
C. Set up and submit a letter of engagement to the directors of the company.
D. Ensure that the outgoing auditors’ removal/resignation has been properly
conducted.

SCENARIO QUESTIONS
Question 1
It is 1 July 20X5. You are an audit manager in Welford & Co, a firm of Chartered
Certified Accountants. Your role includes performing post-issuance audit quality
reviews, and you have been asked to review the audit work performed on Rivers Co for
the financial year ended 31 January 20X5. You have gathered the following information
from your review of the audit file:

Audit team and fees

Rivers Co is a listed company operating in the construction industry. The company

complies with corporate governance regulations and has an audit committee. Rivers Co
has been an audit client of Welford & Co for eight years, and Bob Newbold has been
the audit engagement partner during this time. Rivers Co’s auditor’s report was signed
by Bob Newbold and issued last week. The report contained an unmodified opinion.

Welford & Co requires its staff to record each hour they spend working on each client
in the firm’s time management system. From reviewing the time records relating to the
audit of Rivers Co, you are aware that Bob and the other audit team members recorded
the following amount of time on the audit:

Bob Newbold – audit engagement partner 2 hours

AOF – Chapter 3: Quality control in audit and assurance service

Pat Canley – senior audit manager 6 hours

Anesa Kineton – audit manager 35 hours

Six audit assistants 130 hours

Total time spent on audit 173 hours

It is apparent from your review that almost all of the detailed review of the audit
working papers was completed by Anesa Kineton, who has evidenced her review by
stating ‘final review’ on each page of the audit file. She has recently been promoted to
audit manager.

Going concern

From reviewing the audit working papers, you are aware that going concern was
identified as a significant audit risk at the planning stage of the audit due to low profit
margins or losses being made on many of the company’s construction contracts and
increasing economic uncertainty.

Most of the audit work on going concern was performed by Mary Loxley, an audit
assistant who has just taken her last professional exam and is not yet qualified.

Required:

Comment on the quality of the planning and performance of the audit of Rivers Co,
discussing the quality control, ethical and other professional issues raised and
recommending appropriate actions to be taken.