AUDITING

Name: Nimisha Darak

Class: SYBcom Sem IV

Division: C

Roll Number: Title: Standards on Quality Control (SQCs) -Basic Understanding

Introduction

The purpose of this Statement on Quality Control Standards (SQCS) is to establish standards
and provide guidance for a CPA firm’s responsibilities for its system of quality control for its
accounting and auditing practice. This statement describes elements of quality control and
other matters essential to the effective design, implementation, and maintenance of the
system. This statement is to be read in conjunction with the AICPA Code of Professional
Conduct.

This statement also sets forth the meaning of certain terms used in SQCSs issued by the
Auditing Standards Board in describing the professional requirements imposed on firms and
engagement partners.

System of Quality Control

The firm must establish a system of quality control designed to provide the firm with
reasonable assurance that the firm and its personnel comply with professional standards and
applicable regulatory and legal requirements, and that the firm or engagement partners issue
reports that are appropriate in the circumstances. A system of quality control consists of
policies designed to achieve these objectives and the procedures necessary to implement and
monitor compliance with those policies.

The nature of the policies and procedures developed by individual firms to comply with this
statement will depend on various factors such as the size and operating characteristics of the
firm. The system of quality control should be designed to provide the firm with reasonable
assurance that the segments of the firm’s engagements performed by its foreign member
firms or offices or by its domestic or foreign affiliates, if any, are performed in accordance
with professional standards in the United States when such standards are applicable.

Professional Requirements

SQCSs contain professional requirements together with related guidance in the form of
explanatory material. Firms have a responsibility to consider the entire text of an SQCS with
regard to their system of quality control and in understanding and applying the professional
requirements of the relevant SQCSs.

Not every paragraph of an SQCS carries a professional requirement that the firm is expected
to fulfil. Rather, the professional requirements are communicated by the language and the
meaning of the words used in the SQCSs.

SQCSs use two categories of professional requirements, identified by specific terms, to

describe the degree of responsibility they impose on firms, as follows:
• Unconditional requirements. The firm is required to comply with an unconditional
requirement in all cases in which the circumstances exist to which the unconditional
requirement applies. SQCSs use the words must or is required to indicate an unconditional
requirement.

• Presumptively mandatory requirements. The firm is also required to comply with a

presumptively mandatory requirement in all cases in which the circumstances exist to which
the presumptively mandatory requirement applies; however, in rare circumstances, the firm
may depart from a presumptively mandatory requirement provided the practitioner
documents his or her justification for the departure and how the alternative procedures
performed in the circumstances were sufficient to achieve the objectives of the
presumptively mandatory requirement. SQCSs use the word should to indicate a
presumptively mandatory requirement.

If an SQCS provides that a procedure or action is one that the firm “should consider,” the
consideration of the procedure or action is presumptively required, whereas carrying out the
procedure or action is not. The professional requirements of an SQCS are to be understood
and applied in the context of the explanatory material that provides guidance for their
application.

Documentation and Communication of Quality Control Policies and Procedures

The firm should document its quality control policies and procedures. The size, structure, and
nature of the practice of the firm are important considerations in determining the extent of the
documentation of established quality control policies and procedures. For example,
documentation of established quality control policies and procedures would generally be
expected to be more extensive in a large firm than in a small firm and in a multi-office firm
than in a single-office firm.

13. The firm should communicate its quality control policies and procedures to its personnel.
Although communication is enhanced if it is in writing, the communication of quality control
policies and procedures is not required to be in writing. Effective communication of the
firm’s quality control policies and procedures:

• Describes the quality control policies and procedures and the objectives they are designed to
achieve;

• Includes the message that each individual has a personal responsibility for quality and is
expected to be familiar with and to comply with these policies and procedures; and

• Stresses the importance of obtaining feedback on its system of quality control from its
personnel and encourages its personnel to communicate their views or concerns on quality
control matters.

Leadership Responsibilities for Quality within the Firm

The firm should establish policies and procedures designed to promote an internal
culture based on the recognition that quality is essential in performing engagements.

Such policies and procedures should require the firm’s chief executive officer (or

equivalent) or, if appropriate, the firm’s managing partners (or equivalent), to assume

ultimate responsibility for the firm’s system of quality control. The firm’s leadership

and the examples it sets significantly influence the internal culture of the firm.

The promotion of a quality-oriented internal culture depends on clear, consistent and

frequent actions and messages from all levels of the firm’s management emphasizing the
firm’s quality control policies and procedures, and the requirement to:

Perform work that complies with professional standards and regulatory and legal

requirements; and

Issue reports that are appropriate in the circumstances.

Such actions and messages encourage a culture that recognizes and rewards high

quality work. They may be communicated by training seminars, meetings, formal or

informal dialogue, mission statements, newsletters, or briefing memoranda. They are

incorporated in the firm’s internal documentation and training materials, and in

partner and staff appraisal procedures such that they will support and reinforce the

firm’s view on the importance of quality and how, practically, it is to be achieved.

Of particular importance is the need for the firm’s leadership to recognize that the

firm’s business strategy is subject to the overriding requirement for the firm to

achieve quality in all the engagements that the firm performs. Accordingly:

The firm assigns its management responsibilities so that commercial

considerations do not override the quality of work performed;

The firm’s policies and procedures addressing performance evaluation,

compensation, and promotion (including incentive systems) with regard to its

personnel, are designed to demonstrate the firm’s overriding commitment to

quality; and

The firm devotes sufficient resources for the development, documentation and
support of its quality control policies and procedures.

Any person or persons assigned operational responsibility for the firm’s quality

control system by the firm’s chief executive officer or managing board of partners

should have sufficient and appropriate experience and ability, and the necessary

authority, to assume that responsibility. Sufficient and appropriate experience and

ability enables the responsible person or persons to identify and understand quality

control issues and to develop appropriate policies and procedures. Necessary

authority enables the person or persons to implement those policies and procedures.

Relevant Ethical Requirements

The firm should establish policies and procedures designed to provide it with reasonable

assurance that the firm and its personnel comply with relevant ethical requirements.

Ethical requirements relating to audits and reviews of historical financial information,

and other assurance and related services engagements are contained in the Code. The

Code establishes the fundamental principles of professional ethics, which include:

Integrity;

Objectivity;

Professional competence and due care;

Confidentiality; and

Professional behavior.

The Code includes a conceptual approach to independence for assurance

engagements, including aspects such as threats to independence, accepted safeguards

and the public interest.

The firm’s policies and procedures should emphasize the fundamental principles,

which are reinforced in particular by (a) the leadership of the firm, (b) education and

training, (c) monitoring, and (d) a process for dealing with non-compliance.

Independence for assurance engagements is so significant that it is addressed

separately below.

Independence

The firm should establish policies and procedures designed to provide it with

reasonable assurance that the firm, its personnel and, where applicable, others subject

to independence requirements (including experts contracted by the firm and network

firm personnel), maintain independence where required by the Code. Such policies

and procedures should enable the firm to:

(a) Communicate its independence requirements to its personnel and, where

applicable, to others subject to them; and

(b) Identify and evaluate circumstances and relationships that create threats to

independence, and to take appropriate action to eliminate those threats or reduce them

to an acceptable level by applying safeguards, or, if considered appropriate, to

withdraw from the engagement.

. Such policies and procedures should enable the firm to:

a. Communicate its independence requirements to its personnel and, where applicable, others
subject to them.

b. Identify and evaluate circumstances and relationships that create threats to independence,
and to take appropriate action to eliminate those threats or reduce them to an acceptable level
by applying safeguards, or, if effective safeguards cannot be applied, withdrawing from the
engagement.

Such policies and procedures should require:

a. The engagement partner to consider relevant information about client engagements,

including the scope of services, to enable him or her to evaluate the overall effect, if any, on
independence requirements.

b. Personnel to promptly notify the engagement partner and the firm of circumstances and
relationships that create a threat to independence so that appropriate action can be taken.

c. The accumulation and communication of relevant information to appropriate personnel so

that:
(i) The firm, the engagement partner, and other firm personnel can readily determine whether
they satisfy independence requirements;

(ii) The firm can maintain and update information relating to independence; and

(iii) The firm and the engagement partner can take appropriate action regarding identified
threats to independence.

The firm should establish policies and procedures designed to provide it with reasonable
assurance that it is notified of breaches of independence requirements, and to enable it to take
appropriate actions to resolve such situations. The policies and procedures should include
requirements for:

a. Personnel to promptly notify the firm of independence breaches of which they become
aware.

b. The firm to promptly communicate identified breaches of these policies and procedures
and the required corrective actions to:

(i) The engagement partner who, with the firm, has the responsibility to address the breach;
and

(ii) Other relevant personnel in the firm and those subject to the independence requirements
who need to take appropriate action.

c. Confirmation to the firm by the engagement partner and the other individuals referred to in
subparagraph b(ii) that the required corrective actions have been taken.

At least annually, the firm should obtain written confirmation of compliance with its policies
and procedures on independence from all firm personnel required to be independent by the
requirements set forth in Rule 101 and its related interpretations and rulings of the AICPA
Code of Professional Conduct (AICPA, Professional Standards, vol. 2, ET sec. 101) and the
rules of state boards of accountancy and applicable regulatory agencies. Written confirmation
may be in paper or electronic form.

The purpose of obtaining confirmation and taking appropriate action on information

indicating noncompliance is to demonstrate the importance that the firm attaches to
independence and keep the issue current for and visible to its personnel.

For all audit or attestation engagements where regulatory or other authorities require the
rotation of personnel after a specified period, the firm’s policies and procedures should
address these requirements.

Acceptance and Continuance of Client Relationships and Specific Engagements

The firm should establish policies and procedures for the acceptance and continuance of
client relationships and specific engagements, designed to provide the firm with reasonable
assurance that it will undertake or continue relationships and engagements only where the
firm:

a. Has considered the integrity of the client, including the identity and business reputation of
the client’s principal owners, key management, related parties, and those charged with its
governance, and the risks associated with providing professional services in the particular
circumstances;

b. Is competent to perform the engagement and has the capabilities and resources to do so;
and

c. Can comply with legal and ethical requirements. The firm should obtain such information
as it considers necessary in the circumstances before accepting an engagement with a new
client, when deciding whether to continue an existing engagement, and when considering
acceptance of a new engagement with an existing client.

To minimize the risk of misunderstandings regarding the nature, scope, and limitations of the
services to be performed, policies and procedures should provide for obtaining an
understanding with the client regarding those services. Professional standards may provide
guidance in deciding whether the understanding should be oral or written.

When issues have been identified, and the firm has decided to accept or continue the client
relationship or a specific engagement, the firm should document how the issues were
resolved.

Factors to consider regarding the integrity of a client include:

• The nature of the client’s operations, including its business practices.

• Information concerning the attitude of the client’s principal owners, key management, and
those charged with its governance toward such matters as aggressive interpretation of
accounting standards and internal control over financial reporting.

The extent of knowledge a firm will have regarding the integrity of a client will generally
grow within the context of an on-going relationship with that client.

Matters to consider in accepting or continuing the client engagement include whether:

• Firm personnel have knowledge of relevant industries or subject matters or the ability to
effectively gain the necessary knowledge;

• Firm personnel have experience with relevant regulatory or reporting requirements, or the
ability to effectively gain the necessary competencies;

• The firm has sufficient personnel with the necessary capabilities and competence;

• Specialists are available, if needed;

• Individuals meeting the criteria and eligibility requirements to perform an engagement
quality control review are available, where applicable; and

• The firm is able to complete the engagement within the reporting deadline.

If a potential conflict of interest is identified in accepting an engagement from a new or an

existing client, the firm should determine whether it is appropriate to accept the engagement.
Where the engagement is accepted, the firm should consider any ethical requirements that
exist under AICPA Interpretation No. 102-2, “Conflicts of Interest,” under Rule 102,
Integrity and Objectivity (AICPA, Professional Standards, vol. 2, ET sec. 102), such as
disclosure of the relationship to the client and other appropriate parties.

Deciding whether to continue a client relationship includes consideration of significant

issues that have arisen during the current or previous engagements, and their implications for
continuing the relationship.

If the firm obtains information that would have caused it to decline an engagement if that
information had been available earlier, policies and procedures on the continuance of the
engagement and the client relationship should include consideration of the professional and
legal responsibilities that apply to the circumstances, and the possibility of withdrawing from
the engagement or from both the engagement and the client relationship.

Policies and procedures on withdrawal from an engagement or from both the engagement and
the client relationship should include documenting significant issues, consultations,
conclusions, and the basis for the conclusions. Policies and procedures may include:

• Discussing with the appropriate level of the client’s management and those charged with its
governance the appropriate action that the firm might take based on the relevant facts and
circumstances.

• Considering whether there is a professional, regulatory, or legal requirement for the firm to
remain in place, or for the firm to report the withdrawal from the engagement or from both
the engagement and the client relationship, together with the reasons for the withdrawal, to
regulatory authorities.

• If the firm determines that it is appropriate to withdraw, discussing with the appropriate
level of the client’s management and those charged with its governance withdrawal from the
engagement or from both the engagement and the client relationship.

In certain situations, the auditor may be appointed by statutory procedures or required by law
or regulation to perform the engagement. Accordingly, certain of the considerations regarding
the acceptance and continuance of client relationships and specific engagements, as set out in
paragraphs 27–35, may not be relevant. Nonetheless, establishing policies and procedures as
described may provide valuable information to public sector auditors in performing risk
assessments and in carrying out reporting responsibilities.
In practice, the competency requirements necessary for the engagement partner are
broad and varied in both their nature and number. Required competencies include the
following, as well as other competencies as necessary in the circumstances

• Understanding of the role of a system of quality control and the Code of Professional
Conduct. An understanding of the role of a firm’s system of quality control and the AICPA’s
Code of Professional Conduct, both of which play critical roles in assuring the integrity of the
various kinds of reports.

• Understanding of the service to be performed. An understanding of the performance,

supervision, and reporting aspects of the engagement. This understanding is usually gained
through actual participation under appropriate supervision in that type of engagement.

• Technical proficiency. An understanding of the applicable professional standards including

those standards directly related to the industry in which a client operates and the kinds of
transactions in which a client engages.

• Familiarity with the industry. An understanding of the industry in which a client operates, to
the extent required by professional standards applicable to the kind of service being
performed. In performing an audit or review of financial statements, this understanding
would include an industry’s organization and operating characteristics sufficient to identify
areas of high or unusual risk associated with an engagement and to evaluate the
reasonableness of industry-specific estimates.

• Understanding the organization’s information technology systems. A sufficient

understanding of how the organization is dependent on or enabled by information
technologies and the manner in which the information systems are used to record and
maintain financial information, to determine when involvement of an IT professional is
necessary for an audit engagement.

Professional judgment

Skills that indicate sound professional judgment. In performing engagements covered by this
statement, such skills would typically include the ability to exercise professional skepticism
and identify areas requiring special consideration including, for example, the evaluation of
the reasonableness of estimates and representations made by management and the
determination of the kind of report appropriate in the circumstances.