ISQM 1 and What Audit Quality Actually Means

Audit quality is a difficult thing to buy, because you cannot observe it. Two audits can look identical from the client side: same requests, same meetings, same opinion. The difference shows up years later, if at all, usually when someone else looks at the same numbers and reaches a different conclusion.

ISQM 1, adopted in Canada as CSQM 1, is the standard that governs how firms manage this. It is worth understanding at a high level, because it gives you a vocabulary for asking your auditor useful questions.

What changed

The old standard, ISQC 1, told firms what policies to have. Firms adopted the policies, documented them, and were inspected against them. The weakness was obvious in hindsight: a firm could have every required policy and still produce poor audits, because policies are not the same as behaviour.

ISQM 1 inverts this. A firm has to identify the quality risks arising in its own practice, design responses proportionate to those risks, operate them, monitor whether they work, and reach a documented conclusion annually about whether the system is effective.

That last part matters. Someone in the firm has to conclude, in writing, once a year, that the quality management system provides reasonable assurance that engagements are performed properly. It is an accountability mechanism as much as a technical one.

The components that affect your audit

Eight components make up the system. Four of them affect what happens on your engagement directly.

Engagement acceptance and continuance. Whether the firm should take on or keep a client. A firm that accepts work it cannot resource, or keeps a client whose management it does not trust, has created a quality risk before the audit starts. Ask whether the firm has ever resigned an engagement. The answer is informative.

Resources. People, technology and methodology. Whether the firm has enough people with the right competence available at the time your audit runs. Busy season capacity is where this is tested. A firm that wins more December year ends than it can staff will manage the shortfall somewhere.

Engagement performance. Direction, supervision and review. Who reviews the file, when, and with what authority to change the conclusion. A review that happens after the opinion is drafted is not the same as one that shapes it.

Monitoring and remediation. Whether the firm inspects its own completed engagements, finds deficiencies, and fixes the underlying cause rather than the individual file. This is the component most often done thinly, because it involves a firm telling itself unwelcome things.

Questions worth asking your auditor

These are not gotcha questions. A firm that takes quality seriously will answer them comfortably.

Who performs the engagement quality review on our audit, and when? An EQR is required on some engagements and used voluntarily on others. You want to know whether one applies to you and whether it happens before or after the file is substantially complete.

What did your last internal inspection find, and what did you change? Every firm’s inspections find something. A firm that says its inspections found nothing is either not looking or not telling you.

Have you been inspected by your regulator, and what came of it? Public bodies publish inspection results. Firms below that threshold still have oversight. The willingness to discuss it is the signal.

How do you resource busy season? Specifically, how many engagements with our year end does the partner run, and what happens if two overrun simultaneously.

Who signs, and who reviews the person who signs? In small firms the answer is sometimes uncomfortable. It is better to know.

Why this matters commercially, not just technically

An audit opinion is a product whose value depends entirely on the credibility of the person giving it. If your lender, your buyer or your regulator does not find the opinion credible, you have paid for compliance rather than assurance.

Quality management systems are how a firm makes its opinions credible at scale. They are also, unglamorously, how a firm avoids the failure that ends up in a headline with a client’s name attached to it.

You are entitled to ask. The firms worth appointing expect the question.