[FAQs] on Quality Control for an Audit of Financial Statements

Implementation of Quality Control Procedures:

• SQC 1 requires that firm should establish a system of quality control designed to provide it with reasonable assurance that firm and its personnel comply with professional standards and legal and regulatory requirements. It further requires that firm’s business strategy is subject to overriding requirement of firm to achieve quality in all engagements. However, in the given situation, commercial considerations seem to be overriding factor. It reflects poorly regarding functioning at top of the firm as regards to quality control.
• The managing partner of firm is close associate and family friend of promoter. The matter should have been brought to knowledge of firm in accordance with requirements of SQC 1 as it involves issue of independence of managing partner of the firm with respect to proposed audit engagement. Further, matters of inquiries from regulators and resignation of previous auditor raise question about integrity of the proposed client. SQC 1 further requires firm to consider before acceptance of an engagement that client does not lack integrity. All these factors need to be taken into consideration before accepting engagement.

Conclusion: Overall, such a situation reflects lack of proper establishment of quality control framework at top of the firm.

Considerations to be taken into account while upholding quality of firm:

(i) Firm assigns its management responsibilities so that commercial considerations do not override quality of work performed.

(ii) Firm’s policies and procedures in relation to its personnel are designed to demonstrate its overriding commitment to quality.

(iii) Firm devotes sufficient resources for development and documentation of its quality control policies and procedures.

(iv) Firm before accepting an engagement should acquire vital information about the client. Such an information should help firm to decide about integrity of Client, promoters and key managerial personnel, competence (including capabilities, time and resources) to perform engagement and compliance with ethical requirements.

Considerations as to integrity of clients:

As per SQC-1 “Quality Control for Firms that Perform Audits and Reviews of Historical Financial Information, and Other Assurance and Related Services Engagements”, a firm should obtain such information as it considers necessary in the circumstances before accepting an engagement with a new client, when deciding whether to continue an existing engagement, and when considering acceptance of a new engagement with an existing client. Where issues have been identified, and the firm decides to accept or continue the client relationship or a specific engagement, it should document how the issues were resolved.

Considerations as to integrity of clients:

With regard to the integrity of a client, matters that the firm considers include, for example:

1. The identity and business reputation of the client’s principal owners, key management, related parties and those charged with its governance.
2. The nature of the client’s operations, including its business practices.
3. Information concerning the attitude of the client’s principal owners, key management and those charged with its governance towards such matters as aggressive interpretation of accounting standards and the internal control environment.
4. Whether the client is aggressively concerned with maintaining the firm’s fees as low as possible.
5. Indications of an inappropriate limitation in the scope of work.
6. Indications that the client might be involved in money laundering or other criminal activities.
7. The reasons for the proposed appointment of the firm and non-reappointment of the previous firm.

The extent of knowledge a firm will have regarding the integrity of a client will generally grow within the context of an ongoing relationship with that client.

Quality Control Issues in an engagement:

• SQC 1 “Quality Control for Firms that perform Audits and Reviews of Historical Financial Information and Other Assurance and Related Services Engagements” requires a firm to establish the policies & procedures for dealing/resolving differences of opinion with in engagement team.
• An engagement partner is usually appointed to each audit engagement undertaken by the firm, to take responsibility for the engagement on behalf of the firm. Assigning the audit to an experienced audit manager is not sufficient.
• SA 220 “Quality Control for an Audit of Financial Statement”, requires that the audit engagement partner takes responsibility for settling disputes in accordance with the firm’s policy in respect of resolution of difference of opinion required by SQC 1.
• In the present case, partners of the firm have decided to leave the audit in the hands of Audit manager and no engagement partner has been assigned. The lack of an audit engagement partner also means that several of the requirements of SA 220, about ensuring that engagements in relation to independence and directing, supervising and reviewing the audit are not in place.
• Further, the audit manager and senior have conflicting views about the valuation of inventory. This does not appear to have been handled well, with the manager refusing to discuss the issue with the senior.

Conclusion: Failure to resolve the difference of opinion is a breach of the firm’s policy under SQC 1. It indicates that the firm does not have a suitable policy concerning such disputes required by SQC 1.

Complaints and Allegations:

• As required by SQC-1 “Quality Control for Firms that Perform Audits & Reviews of Historical Financial Information, and Other Assurance & Related Services Engagements” the firm should establish policies and procedures designed to provide it with reasonable assurance that it deals appropriately with:

(a) Complaints and allegations that the work performed by the firm fails to comply with professional standards and regulatory and legal requirements; and

(b) Allegations of non-compliance with the firm’s system of quality control.

• Complaints and allegations (which do not include those that are clearly frivolous) may originate from within or outside the firm. They may be made by firm personnel, clients or other third parties. They may be received by engagement team members or other firm personnel.
• As part of this process, the firm establishes clearly defined channels for firm personnel to raise any concerns in a manner that enables them to come forward without fear of reprisals.
• The firm investigates such complaints and allegations in accordance with established policies and procedures. The investigation is supervised by a partner with sufficient and appropriate experience and authority within the firm but who is not otherwise involved in the engagement, and includes involving legal counsel as necessary. Small firms and sole practitioners may use the services of a suitably qualified external person or another firm to carry out the investigation. Complaints, allegations and the responses to them are documented.
• Where the results of the investigations indicate deficiencies in the design or operation of the firm’s quality control policies and procedures, or non-compliance with the firm’s system of quality control by an individual or individuals, the firm shall take appropriate action.

Consideration to be given while reviewing the work:

• As per SQC 1, “Quality Control for Firms that Perform Audits and Reviews of Historical Financial Information and Other Assurance and Related Services Engagements”, review responsibilities are determined on the basis that more experienced team members, including the engagement partner, review work performed by less experienced team members.
• While reviewing the work performed by less experienced members of the engagement team, the reviewers should consider whether:

(i) The work has been performed in accordance with professional standards and regulatory and legal requirements.

(ii) Significant matters have been raised for further consideration.

(iii) Appropriate consultations have taken place and the resulting conclusions have been documented and implemented.

(iv) There is a need to revise the nature, timing and extent of work performed.

(v) The work performed supports the conclusions reached and is appropriately documented.

(vi) The evidence obtained is sufficient and appropriate to support the report; and

(vii) The objectives of the engagement procedures have been achieved.

Areas to be considered in review of audit work:

As per SQC 1, review responsibilities are determined on the basis that more experienced engagement team members, including the engagement partner, review work performed by less experienced team members.

Reviewers consider whether:

(a) The work has been performed in accordance with professional standards and regulatory and legal requirements;

(b) Significant matters have been raised for further consideration;

(c) Appropriate consultations have taken place and the resulting conclusions have been documented and implemented;

(d) There is a need to revise the nature, timing and extent of work performed;

(e) The work performed supports the conclusions reached and is appropriately documented;

(f) The evidence obtained is sufficient and appropriate to support the report; and

(g) The objectives of the engagement procedures have been achieved.

Compliance with SQC:

The firm should establish policies and procedures:

(i) Setting out criteria for determining the need for safeguards to reduce the familiarity threat to an acceptable level when using the same senior personnel on an assurance engagement over a long period of time; and

(ii) For all audits of financial statements of listed entities, requiring the rotation of the engagement partner after a specified period in compliance with the Code.

The familiarity threat is particularly relevant in the context of financial statement audits of listed entities. For these audits, the engagement partner should be rotated after a pre-defined period, normally not more than 7 years.

Conclusion: Firm is not complying with SQC 1 as Engagement Partner H is continuing for more than 7 years.

Responsibilities of EP and EQCR in relation to assessment of independence:

• As per SA 220 “Quality control for an Audit of Financial Statements” the engagement partner shall form a conclusion on compliance with independence requirements that apply to the audit engagement. In doing so, the engagement partner shall:

(a) Obtain relevant information from the firm and, where applicable, network firms, to identify and evaluate circumstances and relationships that create threats to independence;

(b) Evaluate information on identified breaches, if any, of the firm’s independence policies and procedures to determine whether they create a threat to independence for the audit engagement; and

(c) Take appropriate action to eliminate such threats or reduce them to an acceptable level by applying safeguards, or, if considered appropriate, to withdraw from the audit engagement, where withdrawal is permitted by law or regulation. The engagement partner shall promptly report to the firm any inability to resolve the matter for appropriate action.

• For audits of financial statements of listed entities, the engagement quality control reviewer, on performing an engagement quality control review, shall also consider among other things, the engagement team’s evaluation of the firm’s independence in relation to the audit engagement.

Conclusion: View of EP that matters related to independence assessment are the responsibility of the EP and not EQCR is not correct. The independence assessment documentation should also be given to EQCR for his review.

Review of Work performed by others:

• As per SA 220, “Quality Control for an Audit of Financial Statements”, the engagement partner shall take responsibility for reviews being performed in accordance with the firm’s review policies and procedures. Review procedures consists of the considerations, whether:
  1. the work has been performed in accordance with professional standards and regulatory and legal requirements;
  2. significant matters have been raised for further consideration;
  3. appropriate consultations have taken place and the resulting conclusions have been documented and implemented;
  4. the work performed supports the conclusions reached and is appropriately documented;
  5. the evidence obtained is sufficient and appropriate to support the auditor’s report; and
  6. the objectives of the engagement procedures have been achieved.
• When the auditor delegates work to assistants or uses work performed by other auditors/experts he will continue to be responsible for forming and expressing his opinion on the financial statements. However, he will be entitled to rely on the work performed by others, provided he exercises adequate skill and care and is not aware of any reason to believe that he should not have so relied.
• The auditor should carefully direct, supervise and review work delegated to assistants. He should obtain reasonable assurance that work performed by other auditors/experts and assistants is adequate for his purpose.
• In the instant case, Mr. Suresh, a partner of the firm had completed routine audit work and died before signing audit report. Mr. Chandra another partner of the firm has signed the accounts of SC Ltd, relying on the work performed by Mr. Suresh.

Conclusion: CA Chandra is allowed to sign the audit report, though, will be responsible for expressing the opinion. He may rely on the work performed by CA Suresh provided he further exercises adequate skill and due care and review the work performed by him.: CA Chandra is allowed to sign the audit report, though, will be responsible for expressing the opinion. He may rely on the work performed by CA Suresh provided he further exercises adequate skill and due care and review the work performed by him.

Review by Engagement Partner:

• As per SA 220, “Quality Control for an Audit of Financial Statements”, the engagement partner shall take responsibility for reviews being performed in accordance with the firm’s review policies and procedures. For audits of financial statements of listed entities, the engagement partner shall:

(a) Determine that an engagement quality control reviewer has been appointed;

(b) Discuss significant matters arising during the audit engagement, including those identified during the engagement quality control review, with the engagement quality control reviewer; and

(c) Not date the auditor’s report until the completion of the engagement quality control review.

• Further, SA 700, “Forming an Opinion and Reporting on Financial Statements”, requires the auditor’s report to be dated not earlier than the date on which the auditor has obtained sufficient appropriate evidence on which to base the auditor’s opinion on the financial statements.
• In the present case, OP & Associates are the statutory auditors of a listed company which started its operations 5 years back. The field work during the audit of the financial statements of the company for the year ended on March 31, 2023 got completed on July 1, 2023. The auditor’s report was dated July 12, 2023. During the documentation review of the engagement, it was observed that the engagement quality control review was completed on July 15, 2023.

Conclusion: Signing of auditor’s report i.e. on July 12, 2023 which is before the completion of review engagement quality control review i.e. July 15, 2023, is not in order.

Information assisting auditor in accepting and continuing of relationship with the client:

• SA 220, “Quality Control for an Audit of F.S.” and SQC 1, “Quality Control for Firms that Perform Audits and Reviews of Historical Financial Information, and Other Assurance and Related Services Engagements”, requires the firm to obtain information considered necessary in the circumstances before accepting an engagement with a new client, when deciding whether to continue an existing engagement, and when considering acceptance of a new engagement with an existing client.
• Information such as the following assists the engagement partner in determining whether the conclusions reached regarding the acceptance and continuance of client relationships and audit engagements are appropriate:

(i) The integrity of the principal owners, key management and TCWG of the entity;

(ii) Whether the engagement team is competent to perform the audit engagement and has the necessary capabilities, including time and resources.

(iii) Whether the firm and the engagement team can comply with relevant ethical requirements; and

(iv) Significant matters that have arisen during the current or previous audit engagement, and their implications for continuing the relationship.