Quality management for audits – The Engagement Quality Review

This is the first time that the requirements for the Engagement Quality (EQ) review have been set out in a separate standard. ISQM(UK) 2 provides a single standard which addresses the appointment and eligibility of the EQ reviewer, and the reviewer’s responsibilities relating to the performance and documentation of their review.

Previously these requirements were contained across ISQC(UK) 1, which will be withdrawn when the two quality management standards come into force, and ISA(UK) 220 which is being updated as part of the changes coming into force. Note that these earlier requirements referred to the Engagement Quality Control Review, so the first thing to get to grips with is the change of name, although in practice it is likely that the term hot review will often be used. It is hoped that by having a separate standard for the EQ review, it will provide a number of benefits, including:

• Place greater emphasis on the importance of the EQ review;
• Enhance the robustness of the requirements for the eligibility of EQ reviewers and the performance and documentation of the review;
• Provide a mechanism to more clearly differentiate between the responsibilities of the firm and the EQ reviewer; and
• Increase the scalability of the sister standard ISQM(UK) 1 where a firm determines that there are no audit engagements for which an EQ review is an appropriate response to address one or more quality risks.

The need to have policies or procedures in place in respect of the EQ review is not a new requirement, with ISQC(UK) 1 having similar requirements. However, firms will need to revisit and update their existing arrangements to ensure compliance with the new requirements.

When is an EQ review required?

ISQM(UK) 1 acknowledges that the performance of an EQ review will be common approach to addressing the quality risks that may be exist in an engagement. An objective evaluation of the significant judgements made by the engagement team and the conclusions they have reached should help to ensure that those conclusions are appropriate and that the correct form of audit opinion / report is given.

As such every firm will need to establish policies or procedures that address EQ reviews, including identifying the circumstances when an EQ review is required. As a minimum this will need to include the following types of engagement:

• The audit of financial statements of listed entities;
• Audits or other engagements for which an EQ review is required by law or regulation;
• Audits or other engagements for which the firm determines that an EQ review is an appropriate response to address one or more quality risk(s);
• Audits of financial statements of public interest entities;
• Public reporting engagement carried out in accordance with the Standards of Investment Reporting; and
• Engagements for which an EQ review is required by the FRC’s Providing Assurance on Client Assets to the Financial Conduct Authority standard.

Situations where a firm could consider it appropriate to require an EQ review in order to address quality risks could be where the audit engagement partner has only been recently appointed and lacks experience in the role, the engagement is deemed to be high risk, the engagement involves a high level of complexity or judgement or where it relates to a specialist assignment such as a charity or pension scheme audit where the engagement team may not be familiar with all the reporting requirements that may exist. An EQ review may also be undertaken as a form of safeguard to address threats to the auditor’s independence and objectivity that are identified in order to ensure compliance with the FRC’s Ethical Standard. Therefore, the scope of EQ reviews may be wider than what firms are currently using from an EQC review perspective.

With the firm’s policies or procedures in place, it becomes the audit engagement partner’s responsibility to determine that an EQ review has been appointed on a particular assignment, and to inform the relevant person in the firm that an EQ reviewer needs to be appointed. They will need to ensure that they and all member of the engagement team cooperate with the EQ reviewer to ensure that their review can be conducted appropriately.

Who can perform the EQ review?

As part of their policies or procedures the standard introduces the need for the firm to appoint an individual who is responsible for the appointment of EQ reviewers to individual engagements. This person will need to have the competence and capabilities necessary for the role, as well as having sufficient authority within the firm to fulfil the responsibility, and as such it will often be undertaken by the firm’s Audit Compliance Principal or their deputy. The independent appointment of the EQ reviewer should help to ensure that suitable individuals are appointed in each case and avoid any potential for audit quality to be impaired by allowing the engagement team to appoint an EQ reviewer who might be seen to be favourable to the approach they have taken and lack the necessary objectivity. The standard does acknowledge though that this approach will not always be possible, for example in smaller firms where there is a lack of potential candidates for the position of EQ reviewer.

In determining who should be appointed as EQ reviewer on a particular engagement, the firm’s policies or procedures will need to ensure that the following are considered:

• Whether they have the competence and capabilities, including sufficient time, and the appropriate authority to perform the EQ review. This could include knowledge of the industry and reporting framework specific to the entity and the status of the reviewer within the firm to ensure that any points arising from their review are acted upon.
• That relevant ethical requirements are being complied with, including those in relation to threats to objectivity and independence. Past involvement as part of the engagement team for the client may impair objectivity, and ISQM(UK) 2 contains a new requirement for a two year cooling off period before a previous engagement partner on an assignment can act as the EQ reviewer to help address this. A similar approach could be adopted for other persons that are former engagement team members that are being considered as a potential EQ reviewer. The existence of any personal relationships with current members of the engagement team could also influence objectivity and should be considered as part of the appointment process.
• That any legal or regulatory requirement relevant to the appointment of the EQ reviewer are complied with. For example, the firm’s regulator may require that the EQ review is undertaken by a person external to the firm.

In many cases the firms policies or procedures will involve creating a panel of individuals who can perform EQ reviews, which could comprise individuals within the firm or external bodies such as Mercia who can perform EQ reviews where a firm lacks a suitable individual internally that can perform the role. Except for the audit of public interest entities, the EQ reviewer need not be a responsible individual, although they will need to be able to demonstrate that they have the skills and experience necessary for the role and have sufficient status to ensure that any issues arising from their review are acted upon. All potential EQ reviewers will need to be able to demonstrate that they have a thorough understanding of the standard’s requirements before taking on the role, including the need for them to take overall responsibility for the performance of the EQ review.

A firm’s policies or procedures should address the use of individuals who assist the EQ reviewer in the course of their work, although this is unlikely to be of relevance except to larger firms and the review of more complex assignments. Of greater relevance to smaller firms is the need for their policies or procedures to address circumstances when the EQ reviewer’s ability to perform the role becomes impaired.

What does the EQ review involve?

The standard provides a prescriptive list of procedures that the EQ reviewer is required to consider as part of their work.

There is a specific requirement that the EQ reviewer considers the firm’s compliance with relevant ethical requirements, and to form an independent opinion on the appropriateness and adequacy of the safeguards applied. As part of this review, they will need to ensure that ethics issues have been adequately documented.

The other procedures that the EQ reviewer is required to perform includes the following:

• To read and obtain an understanding of information communicated by a) the engagement team regarding the nature and circumstances of the engagement, and b) the firm related to the firm’s monitoring and remediation process, and in particular identified deficiencies that may relate to, or affect, the areas involving significant judgements made by the engagement team.
• Discussion with the engagement partner and other members of the team of significant matters and significant judgements made in planning, performing and reporting on the engagement.
• Based on the above points, review selected documentation related to the significant judgements made by the engagement team and evaluate whether the conclusions reached are appropriate and the documentation supports these conclusions, including whether adequate professional scepticism has been exercised.
• Evaluate whether appropriate consultation has taken place on difficult or contentious matters, including those involving differences of opinion.
• [For audits of financial statements] Evaluate the basis for the engagement partner’s determination that relevant ethical requirements relating to independence have been fulfilled.
• [For audits of financial statements] A new requirement introduced by the standard to evaluate the basis for the engagement partner’s determination that their involvement in the engagement has been sufficient and appropriate such that they are satisfied that the judgements and conclusions reached throughout the audit process are appropriate.
• [For audits of financial statements] Review the financial statements and the audit report.
• [For review engagements] Review the financial statements and the engagement report.
• [For other assurance and related services engagements] Review the engagement report, and when applicable, the subject matter information.

Any concerns that the EQ reviewer has with the quality of the work and the significant judgements and conclusions reached should be notified to the engagement partner so that they can be resolved. If they are not subsequently resolved to the EQ reviewer’s satisfaction, then the EQ reviewer should inform the appropriate person with the firm (likely to be the Audit Compliance Partner) that they have been unable to complete their review. Hopefully though in most situations any issues will be resolved to the EQ reviewer’s satisfaction, and once the EQ review is complete it is the responsibility of the EQ reviewer to inform the engagement partner of this so that they can complete the assignment.

For audit firms that utilise an established audit methodology, such as that published by Mercia, use of the standard forms included as part of the package should help to ensure that all of the standard’s requirements are being met, and that they have been documented appropriately. The documentation of the EQ review needs to be sufficient to demonstrate the nature, timing and extent of the procedures that have been performed. This will need to include the following:

• The name of the EQ reviewer and any individuals that have assisted them;
• An identification of the engagement documentation that has been reviewed;
• The basis for the EQ reviewer’s determination that the requirements of the standard have been complied with;
• The notification by the EQ reviewer to the engagement partner that the EQ review is complete, or alternatively their notification to an appropriate person that they have been unable to complete their review; and
• The date of the EQ review.

There are additional procedures and documentation requirements that also need to be addressed as part of the EQ review of the audit of a public interest entity that are outlined in the standard.

When should the EQ review take place?

The timing of the EQ reviewer’s work is critical if it is to be effective in ensuring audit quality and promote audit efficiency. Fundamentally the EQ review needs to be complete and any matters arising resolved before the engagement partner signs the audit / assurance / engagement report. The engagement partner should not do sign a report until they have been notified by the EQ reviewer that their review is complete.

This means ensuring that there is sufficient time planned in the completion of the engagement for the performance of the EQ review and to address any issues arising from that review. With client pressure to sign off quickly the EQ review needs to be reflected when planning the audit engagement.

Whilst in most cases the majority of the EQ reviewer’s work will need to take place late on in the audit process in order to be able to fully consider the conclusions that have been reached by the engagement team, many firms will also find it useful to have the involvement of the EQ reviewer in the planning of the audit so that any issues related to the risk assessment and determination of the audit approach can be addressed early on.

When does ISQM(UK) 2 take effect?

ISQM (UK) 2 will come into force for the audit of financial statements for period beginning on or after 15 December 2022, and other assurance and related services engagements beginning on or after that date also. Early adoption is strongly encouraged though by the FRC as it seeks to improve the quality of auditing in the UK. ISQM (UK) 2 is applied on the premise that the firm is subject to ISQM (UK) 1.

How Mercia can help

Under the new standards firms will continue to be able to utilise external service providers such as Mercia to undertake EQ reviews as part of their system of quality management. We have experience of a wide range of client types and can provide an objective opinion of whether the procedures performed, judgements made, and conclusions reached are appropriate, and can advise on what additional procedures may be required before the audit is completed in order to be able to demonstrate compliance with the relevant standards.

For more information on this and other forms of peer review we can offer see here.

Users of the Mercia Audit Manual Package (UK) will already be aware that it addresses the issue of audit quality within the Audit Procedures Manual, as well as providing standard documentation for the performance of the EQ review with the Audit Manual itself. We are currently in the process of assessing how our methodology needs to change in response to the proposed new standards so that our products continue to provide you with the guidance and support that you require. If you would like to be involved in the development of these areas within our product base.

Please contact Jenny Faulkner (Head of Publications – Assurance and Financial Reporting).