Standardizing Quality Management for CPA Firms

To which level of an organization do the Statements on Quality Management Standards (SQMS) apply?

The firm level.

According to the AICPA code, which types of services require a firm to have a system of quality management?

Audits, attestation, and accounting and review services.

What is the primary purpose of a CPA firm's quality management system?

To ensure engagements follow professional standards and issued reports are appropriate for the circumstances.

How often are CPA firms required to evaluate their system of quality management?

Annually.

Who typically holds the ultimate responsibility for a firm's system of quality management?

The CEO or the managing partner.

What must occur before finishing an engagement if a disagreement arises during an expert consultation?

The disagreement must be resolved.

What three qualifications must individuals assigned to operational quality management roles possess?

• Right knowledge

• experience

• authority.

What is required of the communication line between operational quality leaders and firm leadership?

A direct line of communication without bottlenecks or filtering.

Why must the system of quality management be designed with flexibility?

To respond to different risks and circumstances faced by the firm and its engagements.

The AICPA identifies _____ essential components of a functioning system of quality management.

Eight

Risk assessment process.

involves identifying objectives and designing responses to threats

Governance and leadership.

SQMS component focuses on the 'tone at the top' and the firm's culture

Ethical requirements.

Integrity, objectivity, and independence

Acceptance and continuance of client relationships and specific engagements.

determines if a firm should take on a new client based on credibility and resources

Engagement performance.

covers the actual execution of work, including supervision and skepticism

Resources

Human, technological, and intellectual assets

Information and communication.

ensures the right data flows to the right people at the right time

Monitoring and remediation.

checking if policies are functioning as designed and fixing issues

What is the first step in the SQMS risk assessment process?

Identifying quality objectives.

In the SQMS risk assessment process, what term describes threats to achieving quality objectives?

Quality risks.

Client complexity is an example of an _____ risk bucket in the risk assessment process.

Engagement-specific

How often must required personnel provide documented confirmation of compliance with independence requirements?

At least annually.

What must a firm do if they receive information after accepting a client that would have caused them to decline the engagement?

Establish and follow policies and procedures for handling such information.

How can leaders demonstrate a commitment to quality in the governance and leadership component?

Making strategic decisions with quality in mind rather than just financial goals.

Why might a firm establish a policy banning all client gifts, even though the official code allows small ones?

To ensure independence is crystal clear beyond the minimum requirements.

Before accepting a new engagement, what resource-related factor must the firm evaluate?

Whether they have enough staff, specialists, and reviewers for the engagement.

What is an inappropriate basis for a firm's client acceptance policy?

Basing the decision solely on hitting financial or revenue goals.

Who has the overall accountability for a specific engagement's performance?

The engagement partner.

In engagement performance, what determines the necessary level of supervision?

The situation and the experience level of the staff members.

To maintain good quality management in accounting and auditing the mnemonic is…

R- resources

E- engagement performance

A- firms risk assessment process

L- governance and leadership

M- monitoring and remediation process

I- information and communication

C- acceptance and communication

E- ethical requirements

Technology resources in an SQMS include IT systems and _____ software.

Audit

What are intellectual resources in the context of a firm's quality management?

The firm's own policies, methodologies, or accounting guides.

If a firm uses an outside service provider for IT, who is responsible for ensuring the provider meets quality objectives?

The firm.

What is the primary role of monitoring in an SQMS?

To provide leadership with timely information on whether the system is functioning as designed.

What is the requirement for inspecting completed engagements for engagement partners?

At least one completed engagement for each partner on a cyclical basis.

Firms that issue more than _____ audit reports per year must monitor in-process engagements.

100

Under what condition can a firm substitute a peer review for its own engagement inspection?

The firm must keep in mind that peer review findings are not evaluated exactly the same way as SQMS inspections.

What is the ideal characteristic of the person performing the monitoring function?

They should be objective and not part of the engagement team or quality review being inspected.

Term: Finding

Definition: An observation from monitoring that is worthy of attention, which can be positive, neutral, or a potential issue.

How does a 'deficiency' differ from a 'finding' in the monitoring process?

A deficiency is a specific subset of findings that indicates the system does not meet a standard or poses a risk to quality.

What step must a firm take once an issue is identified as a deficiency?

Perform a root cause analysis to determine how widespread the issue is.

Who is ultimately responsible for the quality of a firm that is part of a larger network?

Each individual firm is responsible for its own quality.

Which standards provide the quality control framework specifically for firms auditing public companies?

PCAOB Quality Control standards.

How many key elements are identified in the PCAOB quality control standards?

Five.

List the five elements of PCAOB Quality Control standards.

• Independence integrity

• objectivity

• Personnel management

• Acceptance and continuance

• Engagement performance

• Monitoring

Under PCAOB standards, which element ensures that work is assigned to staff with the right training and proficiency?

Personnel management.

What PCAOB element requires a firm to evaluate the integrity of a client before accepting an engagement?

Acceptance and continuance of clients and engagements.

In PCAOB quality control, who has the responsibility to communicate updates to the system to firm personnel?

The individual or team with ultimate responsibility for the system.

What determines the amount of documentation required for a firm's PCAOB quality control system?

Firm size and structure.

Term: Engagement Quality Review (EQR)

Definition: An objective evaluation of significant judgments and conclusions reached by the audit team before the report is released.

When must an engagement quality review be completed relative to the audit report date?

Before the engagement report is released.

Who is eligible to serve as an Engagement Quality Reviewer?

A partner or qualified person who is not part of the engagement team.

Which types of engagements are typically subject to an EQR?

Those required by law (e.g., government agencies) or those with high identified quality risks.

What should an EQR do if they cannot resolve a concern about a significant judgment with the engagement partner?

Notify the firm that the review cannot be completed and the report cannot be released.

If an annual evaluation finds deficiencies that are severe but not widespread, how is the SQMS conclusion categorized?

A pass except for certain identified deficiencies.

What must be included in the SQMS documentation regarding quality risks?

The firm's quality objectives and the key quality risks that could threaten them.

How long must a firm keep SQMS documentation?

Long enough for the firm and its peer reviewers to monitor the system.

Does a deficiency in the firm's quality system automatically mean a specific audit violated Generally Accepted Auditing Standards (GAAS)?

No, they are separate standards.

How many elements of the firm-level SQMS are applied at the individual engagement level for non-issuers?

Six.

Which two firm-level SQMS components are NOT included in quality management at the engagement level?

Risk assessment process and Information and communication.

Who is responsible for ensuring ethical requirements are met before an audit report for a non-issuer is signed?

The engagement partner.

What is the auditor's goal in an audit of internal control over financial reporting (ICFR) for an issuer?

To provide reasonable assurance about whether material weaknesses exist as of the date of management's assertion.

In an issuer audit, what is the role of the concurring partner?

To provide a high-level review of critical items and significant judgments and approve the issuance of the report.

Under what condition will a concurring partner refuse to sign off on an issuer audit?

If there is a significant deficiency, such as a lack of sufficient appropriate evidence or an inappropriate report.

What must the engagement partner review regarding formal communications for non-issuer audits?

All communications to management and those charged with governance.

Why does a firm perform a root cause analysis for identified deficiencies?

To understand why the failure happened and how to remediate the system effectively.

How does professional skepticism apply to engagement performance?

Personnel should maintain a 'trust but verify' mindset throughout the engagement.

In the context of personnel management, how should promotions be determined?

Based on the person possessing the right qualifications for the new role.

Which SQMS component is being addressed when a firm evaluates its organizational chart for clarity of authority?

Governance and leadership.

What documentation is required from an Engagement Quality Reviewer to show completion?

The reviewer’s name, date of completion, documentation reviewed, and a statement that the review is complete.

What is the focus of quality management at the engagement level?

Executing the specific audit in line with professional standards and facts.

When a firm identifies a deficiency, what are two possible adjustments to the SQMS?

Adding new quality objectives or adjusting the risk assessment.

What is the relationship between the SQMS and the AICPA Code of Professional Conduct?

The code states that firms performing certain services must have a system of quality management.

Engagement team members should feel responsible for sharing important information under which SQMS component?

Information and communication.

What is the requirement for monitoring individuals who run the SQMS?

The firm should periodically evaluate them to ensure they are performing their jobs effectively.