[Analysis] ICAI’s SQM 1 & SQM 2 Standards – What You Need to Know

Standards on Quality Management (SQM) are guidelines issued to enhance the quality of audit and assurance engagements by establishing a risk-based approach to quality management. They replace the earlier Standard on Quality Control (SQC 1) and focus on proactive management of quality at both the firm and engagement levels. SQM 1 outlines the framework for designing, implementing, and operating a System of Quality Management (SOQM) at the firm level, while SQM 2 provides specific requirements for engagement quality reviews. These standards emphasize governance, ethical compliance, risk assessment, and continual improvement to ensure high-quality professional services.

Table of Contents

1. Background
2. Introduction to Quality Management Standards
3. Regulatory Framework in India
4. SQM 1 Quality Management for Firms that Perform Audits or Reviews of Financial Statements, or Other Assurance or Related Services Engagements
5. SQM 2 Engagement Quality Reviews
6. Challenges and The Way Forward

By Pranav Jain – Chartered Accountant

1. Background

• The Present SQC 1 “Quality Control for Firms that Perform Audits and Reviews of Historical Financial Information, and Other Assurance and Related Services Engagements” became effective for all engagements relating to accounting periods beginning on or after April 1, 2009.
• Most Standards on Auditing became effective for engagements relating to accounting periods beginning on or after April 1, 2009 or April 1, 2010 except few revisions in last 15 years:

1. 1. SA 260 (Applicable from 1.4.2017)
   2. SA 299 (Applicable from 1.4.2018)
   3. SA 570 (Applicable from 1.4.2017)
   4. SA 610 (Applicable from 1.4.2016)
   5. SA 700, 701, 705, 706, 720 – (Applicable from 1.4.2018)

• Since the existing standards were issued, there have been significant changes to:

1. 1. Regulatory framework for auditing in response to fraudulent financial reporting across the world.
   2. Technology used in business and in auditing.
   3. Financial Reporting involving fair valuation requiring significant estimates.

• These and other factors required revision in some standards on auditing including those related to Quality.
• AASB of ICAI finalised 7 new Standards on Auditing including 2 Quality Management Standards. SQM 1 & SQM 2 have been issued.
• New Proposed Standards are in line with corresponding International Standards.
• Proposed revised standards will result in conforming amendments in other SA
• Shift from “Control” to “Management”.
• Objective to encourage proactive quality management at firm and engagement level.
• SQM 1: Quality Management for Firms that Perform Audits or Reviews of Financial Statements, or Other Assurance or Related Service Engagements
• SQM 2: Engagement Quality Reviews
• SA 220: Quality Management for an Audit of Financial Statements
• SA 250: Consideration of Laws and Regulations in an Audit of Financial Statements
• SA 315: Identifying and Assessing the Risks of Material Misstatement
• SA 540: Auditing Accounting Estimates and Related Disclosures
• SRS 4400: Agreed-Upon Procedures Engagements

2. Introduction to Quality Management Standards

2.1 Standards on Quality Management

• A paradigm shift in how audit and assurance firms approach the management of quality for the services they provide.
• These standards replace SQC 1, which focused on quality control.
• Change from a control to a management perspective signifies an evolution from reactive quality checks to a proactive, comprehensive, and risk-based approach to quality management.

2.2 Relationship of SQM 1 with SQM 2 and SA 220 (R)

SQM 1 [Quality Management at the firm level]

• Requires the firm to design, implement and operate a SQM to manage the quality of engagements performed by the firm.
• Creates an environment that enables and supports engagement teams in performing quality engagements.

SQM 2 [Engagement Quality Reviews]

• EQR form part of the firm’s SQM.
• SQM 2 builds upon SQM 1 by including specific requirements for:

1. 1. Appointment and eligibility of the EQ Reviewer;
   2. Performance of the EQR;
   3. Documentation of the EQR.

SA 220 (R) [Quality Management at the Engagement Level]

• Deals with auditor’s responsibilities regarding quality management at the engagement level and the related responsibilities of the engagement partner.
• Applies to audits of FS.

2.3 International Experience

• Corresponding ISQM 1 and ISQM 2 became applicable in several jurisdictions with effect from 15th December 2022.
• Firms need to invest significant resources in upgrading quality systems to comply with new Quality Management Standards.
• System of Quality Management is not a standalone system, but an all-pervasive system with all the components of people, processes, and technologies working together.

3. Regulatory Framework in India

• Section 143(9) of the Companies Act, 2013 requires that “Auditor shall comply with the auditing standards”.
• Second Schedule of the Chartered Accountants Act, 1949 states that a member in practice shall be guilty of professional misconduct, if he:
  • Fails to invite attention to any material departure from the generally accepted procedure of audit.

3.1 Standards on Auditing – Corporate Entities

• Section 143(9) Every auditor shall comply with the auditing standards.
• Section 143 (10) The Central Government may prescribe the standards of auditing, or any addendum thereto, as recommended by the Institute of Chartered Accountants of India, constituted under section 338 of the Chartered Accountants Act, 1949 (38 of 1949), in consultation with and after examination of the recommendations made by the National Financial Reporting Authority.

3.2 Standards on Auditing – Non-Corporate Entities

• Mandatory for auditor to ensure compliance with Standards on auditing.
• IAASB issued International Standard on Auditing for Audits of Financial Statements of Less Complex Entities (LCE).
• The Auditing and Assurance Standards Board (AASB) of ICAI had issued the Exposure Draft of SA for LCE for public comments (Standard not yet notified).

3.3 Present Status

• ICAI issued SQM 1 and SQM 2 on 14th October 2024.
• NFRA has objected to issuance of SQM by ICAI.
• ICAI contends that SQMs are different from SA and can be independently issued by ICAI without NFRA’s approval.
• On 11th & 12th November, NFRA has finalized SQMs and other standards.

4. SQM 1 – Quality Management for Firms that Perform Audits or Reviews of Financial Statements, or Other Assurance or Related Services Engagements

4.1 SQM 1

• Applicable to all firms performing:

1. 1. Audits
   2. Reviews
   3. Other Assurance or related services

• No exceptions based on size of the firm or criteria of clients.
• When the firm performs other types of engagements that are not engagements performed under the Engagement Standards (e.g., tax services or consulting services), SQM 1 does not require that the System of Quality Management extend to such engagements.
• Effective Date:

4.2 SQC 1 vs SQM 1

• More proactive approach focused on achieving quality objectives by identifying and responding to risks.
• Expanded requirements to modernize standards and factors affecting the firm’s environment, including requirements to address technology, networks, and the use of external service providers.
• Increases focus on the continual flow of information and appropriate communication internally and externally.
• Proactive monitoring of quality management systems and timely and effective remediation of deficiencies.
• Increased requirements to address firm governance and leadership.

4.3 SQC 1 vs SQM 1 – Components

4.4 Objective of SQM 1

• Paragraph 14 of SQM 1 includes the objective of the firm in managing quality, which is to design, implement and operate a System of Quality Management (SOQM).
• The objective of the SOQM is to provide the firm with reasonable assurance that:

1. 1. The firm and its personnel fulfill their responsibilities in accordance with professional standards and applicable legal and regulatory requirements, and conduct engagements in accordance with such standards and requirements; and
   2. Engagement reports issued by the firm or engagement partners are appropriate in the circumstances.

• Reasonable assurance is high and not an absolute level of assurance.
• There are inherent limitations of a SOQM.
• Such limitations include the fact that human judgment in decision making can be faulty. and that breakdowns in the SOQM may occur, for example, due to:

1. 1. human error or behavior; or
   2. failures in information technology (IT) applications.

4.5 Key Requirements of SQM 1

SQM 1 sets out three steps to the risk assessment process

1. 1. Establish Quality Objectives
   2. Identify & Assess Quality Risks
   3. Design & Implement Responses

Establish the Quality Objectives

• The desired outcomes in firm’s System of Quality Management.
• The quality objectives to be achieved are specified in SQM 1 for the following components:

1. 1. Governance and leadership;
   2. Relevant ethical requirements;
   3. Acceptance and continuance of client relationships and specific engagements;
   4. Engagement performance;
   5. Resources; and
   6. Information and communication.

Identify & Assess Risk

• Many risks could adversely affect the achievement of quality objectives.
• Not all risks are considered as quality risks under SQM 1.
• A risk qualifies as a quality risk when it meets both the following criteria:

1. 1. The risk has a reasonable possibility of occurring.
   2. The risk has a reasonable possibility of individually, or in combination with other risks, adversely affecting the achievement of one or more quality objectives.

• Determination of quality risks requires professional judgement of firm.

Design & Implement Response

• The Firm considers the reasons for assessments of quality risks.
• How, and the degree to which, the conditions, events, circumstances, actions, or inactions affect the quality objectives.
• The possible occurrence of the quality risk
• The firm considers:

1. 1. Nature (e.g. what resources would be needed to support the response, e.g., specialized knowledge or expertise, and what information is needed?).
   2. Timing (e.g. whether the quality risk would be better addressed through a response that is a periodic activity or ongoing activity).
   3. Extent (e.g. whether the response should apply to all events that response relates to , or only a selection of events, for instance all audit engagements or only certain audit engagements).

• The firm should consider whether the response alone is sufficient to address the quality risk, or whether a combination of responses is needed.
• The firm may also design and implement a response that addresses multiple quality risks, provided the response is sufficiently precise to effectively address each of the related quality risks.

4.6 Components of SQM 1

4.6.1 Component 1 – The Firm’s Risk Assessment Process

• A process established by the Firm as part of the SOQM.
• This is the foundation of SQM 1.
• The Firm needs to follow a risk-based approach to quality management which focuses the Firm on:

1. 1. The risks that may arise, given the nature and circumstances of the Firm and the engagements it performs; and
   2. Implementing responses to appropriately address those risks.

• Risk Assessment Process varies from firm to firm and is influenced by the nature and circumstances of the firm, including how the firm is structured and organized.

4.6.2 Component 2 – Governance and Leadership

• Demonstrates a Commitment to Quality through its Culture:

1. The firm’s public interest role;
2. The importance of professional ethics, values and attitudes;
3. The responsibility of all personnel for quality relating to the performance of engagements or activities within the SOQM, and their expected behavior; and
4. Quality in the context of the firm’s strategic decisions and actions, including the firm’s financial and operational priorities.
5. Leadership’s behavior and commitment to quality, and their accountability for quality.
6. The organizational structure of the firm and the firm’s assignment of roles, responsibilities and authority.
7. Addressing resource needs, and resource planning, allocation and assignment, which also include financial resources.

How demonstrated?

• Tone at the top.
• Commitment to quality by all personnel.
• Embedding quality in the firm’s strategic decisions and actions including financial and operational priorities.

4.6.3 Component 3 – Relevant Ethical Requirements

• Principles-based requirements to establish quality objectives addressing the fulfillment of responsibilities in accordance with relevant ethical requirements, including those related to independence.
• Increased focus on all relevant ethical requirements (i.e., not just independence).
• SOQM needs to address the relevant ethical requirements that apply to others outside the firm (i.e., the network, network firms, individuals in the network or network firms, or service providers).

4.6.4 Component 4 – Acceptance and Continuance of Client Relationships and Specific Engagements

• Principles-based requirements to establish quality objectives addressing the acceptance and continuance of client relationships and specific engagements.
• The firm’s SOQM would need to address fulfilling ethical requirements, including conflicts of interest, through the quality objectives dealing with relevant ethical requirements.
• Focus on the firm’s judgments in determining whether to accept or continue the client relationships and specific engagements.
• Enhanced requirement to drive the firm to obtain information about the nature and circumstances of the engagement and the integrity and ethical values of the client (including management, and, when appropriate, those charged with governance).
• New requirement addressing the financial and operational priorities of the firm in the context of making decisions about whether to accept or continue a client relationship or specific engagement.
• The Firm’s policies should include:

1. 1. The information that needs to be gathered about the nature and circumstances of the engagement and the integrity and ethical values of the client. The policies or procedures may also suggest or specify where the information needs to be sourced from.
   2. Set out factors to be considered in determining whether the firm is able to perform the engagement in accordance with professional standards and applicable legal and regulatory requirements.
   3. Specify (or prohibit) the types of engagements that may be performed by the firm, and, may prohibit performing engagements for certain types of entities.

4.6.5 Component 5 – Engagement Performance

• Principles-based requirements to establish quality objectives addressing engagement performance, including consultation, differences of opinion and addressing the assembly, maintenance and retention of engagement documentation.
• New requirement addressing engagement teams’ responsibilities in connection with engagements, including the overall responsibility of an engagement partner for managing and achieving quality on an engagement and being sufficiently and appropriately involved throughout the engagement.
• Enhanced requirement addressing direction and supervision of engagement teams and review of the work performed, which is focused on what is appropriate given the nature and circumstances of the engagements and the resources assigned or made available to the engagement teams.
• New requirement addressing engagement teams exercising appropriate professional judgment and, when applicable to the type of engagement, professional skepticism.
• Engagement Quality Reviews now elaborately covered in SQM 2.

4.6.6 Component 6 – Resources

• New requirements that address the need for technological and intellectual resources to enable the operation of the SOQM and performance of engagements.
• New requirement addressing service providers, i.e., that resources from service providers are appropriate for use in the SOQM and performance of engagements.
• Expanded Requirements for Human Resources:

1. 1. To have competent and capable human resources to perform activities or carry out responsibilities in relation to the operation of the SOQM, and assign individuals to perform activities within the SOQM.
   2. SQM 1 addresses the need to obtain individuals from external resources (i.e., the network, another network firm or a service provider) when the firm does not have the personnel to operate the SOQM or perform engagements; and
   3. New requirement addressing personnel’s commitment to quality and accountability or recognition through timely evaluations, compensation, promotion and other incentives.

4.6.7 Component 7 – Information and Communication

• New Component in SQM 1.
• The information and communication component enables the design, implementation and operation of the SOQM. Accordingly, many aspects of the information and communication component may overlap with other components.
• New and enhanced requirements for obtaining, generating or using information and communicating information, to enable the design, implementation and operation of the SOQM.

SQM addresses the requirements related to:

• The firm’s information system.
• The culture of the firm in the context of information and communication (i.e., recognizing and reinforcing the responsibility of personnel to exchange information with the firm and with one another).
• Exchanging information between the firm and engagement teams.
• Communicating information within the firm’s network and to service providers.
• Other communication externally elated to the SOQM, i.e., when it is required by law, regulation or professional standards, or to support external parties’ understanding of the SOQM.

4.6.8 Component 8 – Monitoring and Remediation

• Monitoring and remediation facilitates the proactive and continual improvement of engagement quality and the SOQM. Identifying and remediating deficiencies is constructive and is an essential part of an effective SOQM.
• The Process:

1. 1. Design & Perform Monitoring Activities
   2. Evaluate findings and identify deficiencies, and evaluate identified deficiencies
   3. Respond to identified Deficiencies
   4. Communicate

• Purpose of Monitoring and Remediation Process is:

1. 1. To monitor the SOQM so that the firm has relevant, reliable and timely information about the design, implementation and operation of the SOQM.
   2. To take appropriate actions to respond to identified deficiencies, such that deficiencies are remediated on a timely basis, to prevent them from reoccurring. Taking appropriate actions may also include, if necessary, rectifying findings that relate to engagements when it appears that procedures were omitted on an ongoing or completed engagement, or a report issued was inappropriate.

4.7 Documentation

• SQM 1 does not prescribe every matter that needs to be documented
• Documentation should achieve three principles:

1. 1. Support a consistent understanding of the SOQM by personnel, including an understanding of their roles and responsibilities with respect to the SOQM and the performance of engagements.
   2. Support the consistent implementation and operation of the responses.
   3. Provide evidence of the design, implementation and operation of the responses, to support the evaluation of the SOQM by the individual(s) assigned ultimate responsibility and accountability for the SOQM.

5. SQM 2 – Engagement Quality Reviews

5.1 Why new separate standard?

• The requirements for engagement quality reviews currently reside in extant SQC 1 and SA 220. SQM 2 replaces the extant provisions relating to engagement quality reviews in SQC 1 and SA 220.
• Placing emphasis on the importance of the engagement quality review.
• Enhancing the robustness of the requirements for the eligibility of EQ Reviewers and the performance and documentation of the review.
• Providing a mechanism to more clearly differentiate the responsibilities of the firm and the engagement quality reviewer.
• Increasing the scalability of SQM 1 because there may be cases when a firm may determine that there are no audits or other engagements for which an engagement quality review is an appropriate response to address one or more quality risk(s).

5.2 Linkage between SQM 1 & SQM 2

• SQM 2 is designed to operate as part of the firm’s system of quality management, and therefore, the requirements in SQM 1 and SQM 2 are organized in a manner that provide appropriate linkages between the standards:

1. 1. SQM 1 addresses the scope of engagements subject to an engagement quality review;
   2. SQM 2 addresses the specific requirements for the appointment and eligibility of the engagement quality reviewer and the performance and documentation of the review.

• Engagement Quality Review (EQR) is a specified response designed and implemented by the firm to address quality risks.
• The performance of an EQ review is undertaken at the engagement level by the EQ reviewer on behalf of the firm.
• SQM 2 addresses:

1. 1. The appointment and eligibility of the EQ reviewer; and
   2. The EQ reviewer’s responsibilities relating to the performance and documentation of an EQ review.

5.3 Objective

The objective of the firm through appointing an eligible engagement quality reviewer, is to perform an objective evaluation of the significant judgements.

5.4 Applicability [Para 34(f)(ii) of SQM 1]

• Audits of financial statements of listed entities.
• Audits or other engagements for which an EQR is required by law or regulation.
• Audits or other engagements for which the firm determines that an EQR is an appropriate response to address on or more Quality risks.
• Effective Date:

The changes in SQM 2 are intended to:

• Extend the scope of engagements subject to an EQ review (in addition to audits of financial statements of listed entities).
• Strengthen the eligibility criteria for an individual to be appointed as an EQ reviewer.
• Enhance the EQ reviewer’s responsibilities relating to the performance (including the nature, timing and extent of procedures) and documentation of the EQ review.

5.5 Enhanced Eligibility Criteria for EQ Reviewers

• Have competence, capabilities, including sufficient time, and appropriate authority.
• Comply with relevant ethical requirements, including objectivity and independence..
• Comply with provisions of law and regulation relevant to eligibility of EQ reviewer
• Requires a cooling-off period of 2 years, or a longer period if required by relevant ethical requirements, before the engagement partner can assume the role of EQ reviewer.
• EQ reviewer to be responsible for the overall performance of the EQ review, and determining the nature, timing and extent of the direction and supervision of assistants, and the review of their work.
• EQ reviewer responsible to perform the EQ review at appropriate points in time during the engagement:

1. 1. Planning of Audit
   2. Performance of Audit
   3. Reporting

• Focuses on significant judgments and significant matters, including, when applicable to the type of engagement, the exercise of professional skepticism by the engagement team.
• Precludes the engagement partner from dating the engagement report until notification has been received from the EQ reviewer that the EQ review is complete.

Requires the firm to establish policies or procedures for:

• The EQ reviewer to take responsibility for documentation of the EQ review.
• The documentation of the EQ review to be included with the engagement documentation.
• Principles-based documentation requirements but clarifies that firm’s policies and procedures may:

1. 1. Specify engagement documentation to be reviewed by EQ reviewer.
   2. Indicate that the EQ reviewer exercises professional judgment in reviewing additional engagement documentation relating to the significant judgments.

6. Challenges and Way Forward

6.1 Challenges and Investments

• Increased focus on risk assessment needing constant evolution, contemporaneous maintenance with the audit practice.
• Governance and leadership considerations at all levels of the firm.
• Focus on the monitoring aspects of the process significantly increases investment needed.
• Emphasis on information and communication.
• The expanded definition of resources in the SQM extends focus to all operational matters, people, tools, data, etc.
• For most firms, the full adherence to SQM will mean need to reassessment of quality processes, partner-level leaders for each of the component of the SQM standard, leading to significant investments, bandwidth demands, without immediate/commensurate fee returns.

6.2 Way Forward

• Establish SQM 1 & SQM 2 within the firm.
• Assign a leader within the firm who has the overall responsibility for the new quality standards.
• May require a dedicated team to implement & monitor SQM 1 and SQM 2.
• Assess whether these are meeting “Quality Management” Objective.
• Redraft checklists for new standards proposed.
• Identify implementation challenges NOW and draw a plan.
• Assess the requirements of new standards and map the resources available- develop a plan to meet the gaps (example: availability of EQR, IT Professionals, etc.)
• Assess the additional effort required to ensure quality and sensitize clients now for additional time and fees.