By Phil Cowperthwaite
An implementation strategy for quality control must be tailored to each firm if controls are to be efficient and effective
Compliance with quality-control requirements is an essential ingredient in any assurance engagement. Every firm in Canada must comply with all the requirements in the Canadian Standard on Quality Control for Firms (CSQC1) that are relevant to its assurance engagements.
However, for the smallest of firms, a one-size-fits-all approach to compliance is probably not efficient. On the contrary — if the controls adopted are to be efficient and effective, the implementation strategy needs to be tailored to each firm.
A very small firm, one with a single partner and one or two professionals on staff, that complies with quality-control requirements at the engagement level (i.e., those specified in CAS 220, Quality control for an audit of financial statements) will also be complying efficiently with almost all the firm-level quality-control requirements. In a much larger office it is more efficient for engagement partners to rely on firm-wide controls. Firms with characteristics of both very small and large firms can look to a hybrid model for efficient quality control.
If, at the same time as complying with engagement quality-control requirements, a small firm is also able to meet the firm’s quality-control requirements, then that firm will have, in part, achieved proportionate implementation of firm-wide quality-control standards.
The exception to proportional implementation of firm-wide controls is engagement partner file inspection. This control provides an important independent check of the quality of work regardless of the characteristics of the firm.
So what factors are essential to a quality audit and how can a very small firm implement controls differently from a large firm, but achieve the same result?
Quality audits: two essential factors
1. Auditor compliance with professional ethical standards — including independence
Auditor compliance with professional ethical standards, including independence, is a cornerstone of the profession and is required in every audit. CSQC1 requires that every firm have policies and procedures to provide it with reasonable assurance that its auditors comply with the relevant ethical and independence requirements. At the engagement level, Canadian auditing standards require that the engagement partner both comply with relevant ethical requirements and be alert for evidence of noncompliance.
In a very small firm, the public accountant is the firm. On every engagement, the practitioner must personally be in compliance with the ethical requirements. Assuming there are only one or two assistants, the practitioner should be able to personally assess the independence of the team through an annual confirmation of independence and regular observation. In short, where the practitioner is the firm, compliance with ethical requirements in every engagement will result in compliance with ethical requirements at the firm level.
Contrast this with a large firm that has many partners and staff and possibly multiple locations. It would be very inefficient to require every engagement partner to comply with all aspects of the ethical requirements on every engagement without the benefit of a firm-wide system of quality control. On every engagement, the engagement partner would have to evaluate circumstances and relationships that create threats to independence on a firm-wide basis, as well as remain alert for evidence that members of the team did not comply with ethical requirements. It is, therefore, not only more efficient but also essential to have a firm-wide system that the engagement partners can rely on for compliance with ethical requirements.
2. Auditor competence and capabilities
Every engagement partner has ultimate responsibility for bringing the necessary competence and capabilities to the table for every engagement he or she performs. No one else can assume that responsibility. In a large firm, new clients are often assigned to engagement partners by the firm’s senior management. Engagement partners can also have staff they do not know assigned to them.
In this environment, it is important to establish policies and procedures at the firm level to ensure that engagements are always run by partners and staff that have the appropriate competence and capabilities.
But in a very small firm, there is little need to adopt a personnel-competence policy at the firm level. This is because the engagement partner, who is the firm, is personally responsible for ensuring every engagement is staffed with competent and capable personnel. Again, compliance with engagement-level competence and capability requirements in a very small firm will result in compliance at the firm level.
The same arguments apply to other quality-control requirements in CSQC1 and CAS 220 in the areas of firm leadership, acceptance and continuance of client relationships, human re-sources, review responsibilities and the remaining engagement performance requirements.
In a very small firm, compliance with these requirements at the engagement level will often result in compliance with firm-wide requirements.
Proportionate implementation of firm-wide quality-control requirements
Assess the characteristics of the firm
But what should be done if a firm falls in size between the very small (where separate quality-control requirements for the firm and individual engagements would seem artificial) and the large firm (where two layers of control are essential)?
At the outset, it is important to decide whether the characteristics of the firm are closer to those at one end of the size spectrum or the other and then devise a suitably proportioned response.
Firms exhibiting the characteristics of a very small firm include those where:
Many two-and three-partner and even some larger firms exhibit many of the characteristics of a very small firm. In these cases, it may be a good idea to focus on quality control on an engagement level when appropriate if that is where controls can be implemented most efficiently.
Firms exhibiting the characteristics of a large firm include those where:
For firms with many large-firm characteristics, it is essential to focus on quality control at both the firm and engagement levels. This allows partnership management to deal with firm-wide issues, such as compliance with ethical standards, hiring and assignment of competent and capable personnel and resolution of disagreements. Engagement partners can then concentrate on engagement quality-control requirements on their individual assignments.
Since the characteristics of professional accounting firms vary, it just makes sense to implement firm-wide controls in a proportionate manner to achieve control objectives efficiently.
Exception to proportional implementation of firm-wide controls: file inspection
This brings us to file-inspection requirements, which must always be applied at a firm level and play a vital role in quality control in every practice.
Auditors are in the business of obtain- ing evidence and expressing a professional opinion on someone else’s work. It is in the public interest that they periodically subject their work to scrutiny to ensure it is conducted in accordance with professional standards. The old adage “What’s sauce for the goose is sauce for the gander” applies perfectly in this situation.
Every assurance engagement is ultimately the responsibility of an individual, regardless of whether that person belongs to a one-person or a 10,000-person firm. Periodic review of an engagement partner’s performance by a qualified independent professional gives the engagement partner valuable insight into the quality of his or her day-to-day work.
File review can only strengthen every engagement partner’s professional performance and, as a result, it contributes to the maintenance of audit quality. However, review of individual engagement files cannot be done proportionately since every engagement partner is required to undergo at least a minimum degree of review, with CSQC1 suggesting inspection of at least one file for every engagement partner every three years as a minimum. For many firms annual inspection is much more effective in achieving the goal of the requirements and reducing firm risk.
Pulling it together
An implementation strategy for quality control must be tailored to each firm if the resulting controls are to be both efficient and effective. Proportionate implementation of controls can be achieved in a very small firm where, if the engagement-level quality-control requirements are met, so too are the firm-wide requirements.
This, combined with the suggestions for a proportional approach explicitly stated in CSQC1 for performance evaluation and documentation of firm-wide systems of control, offers an approach to quality control that is both effective and efficient.
Phil Cowperthwaite, FCA, is a partner of Toronto CA firm Cowperthwaite Mehta and a member of the IFAC’s Small and Medium Practices Committee
Technical editor: Ron Salole, vice-president, Standards, CICA