CalCPA Home > Member Resources > California CPA Magazine > September 2008 Issue > Devil's in the Details
Devil's in the Details
SQCS No. 7: A Firm's System of Quality Control
In Oct. 10, 2007, the AICPA Auditing Standards Board issued Statement on Quality Control Standards (SQCS) No. 7, A Firm’s System of Quality Control, to replace all existing SQCS. The SQCS, which is effective Jan. 1, 2009, deals with a firm’s quality control practices in the areas of audits, reviews, compilations and other attestation engagements. It also places an unconditional obligation on a firm to establish a system of quality control that is designed to provide reasonable assurance that a firm and its personnel comply with professional standards and applicable regulatory and legal requirements, and that the reports issued by the firm or engagement partners are appropriate in the circumstances.
The objectives of SQCS No. 7 are not really different from previous quality control standards. The devil, however, is in the details. The new standard expands current standards and provides guidance consistent with international standards, particularly International Standard on Quality Control (ISQC) 1, Quality Control for Audit, Assurance and Related Services.
A Brief Reminder of Current SQCS
The five elements of quality control are:
Policies and procedures are developed for each of the five elements. The type and number of policies is dependent on many factors, including the firm’s size, structure, etc. Policies may be memorializedin a formal document, or they may be informal and communicated to the appropriate parties verbally.
How is SQCS No. 7 Different?
Engagement Quality Control Review
This review is often referred to as a concurring review. The engagement quality control review occurs before the report is issued. Firms must identify which engagements are to be subject to such a review. In addition, SQCS No. 7 provides guidance on how such a review should be performed. Procedures to be performed in an engagement quality control review include:
• Review of the financial statements and report and consider whether the report is appropriate under the circumstances.
The extent of such a review depends on the complexity of the engagement, and the risk that the report might not be appropriate in the circumstances. And, of course, the results of an engagement quality control review must be documented, specifically stating that the firm’s procedures have been performed, the review was completed before the report was issued and the reviewer is not aware of any unresolved matters.
The new statement also requires firms to establish criteria for the eligibility of engagement quality control reviewers, including technical expertise, objectivity and the proper authority. Qualified persons from outside the firm may be contracted when sole practitioners or small firms identify an engagement requiring an engagement quality control review.
It should be noted that engagement quality control reviews are not required by the new standard. SQCS No. 7 simply states that policies and procedures for such a review should be documented for those firms that have incorporated concurring reviews into their systems of quality control.
Firms still may be able to use this document as a quality control document, as long it is completed by Jan. 1, 2009, periodically reviewed and updated and given to each employee. Simply download the appropriate Quality Control Policies and Procedures Questionnaire (http://aicpa.org/members/div/practmon/systemreview.asp), complete it and give a copy to each member of the firm. Then, annually, update the form for any changes.
Samples of more formalized documents can be found in the AICPA practice aid Establishing and Maintaining a System of Quality Control for a CPA Firm’s Accounting and Auditing Practice (Product No. 006636). It contains sample quality control documents for a firm with multiple offices, a firm with a single office, a sole practitioner and an alternative practice structure. Practitioners Publishing Company has updated its QC Manual as well, and introduced a streamlined version for firms that only do compilation and review work.
A warning to firms preparing to document their quality control system for the first time: be careful to adopt only those policies and procedures that work for your firm. Adoption of a sample quality control document from the AICPA or Practitioners Publishing Company without modification can have disastrous results during peer review if the firm does not have the resources to comply with the policies and procedures adopted.
Elements of Quality Control
• Leadership responsibilities for quality within the firm (tone at the top)
Tone at the top—The firm’s managing partner (or equivalent) should assume ultimate responsibility for quality control by providing leadership and setting an example that promotes a quality-oriented firm culture. To that end, the firm’s quality control system should include policies to:
• Assign management responsibilities so that commercial considerations do not override the quality of work performed.
Peer review has been moving in this direction for several years. The Center for Public Company Audit Firms Peer Review Program established a managing partner questionnaire several years ago, and the AICPA Peer Review Program adopted a similar questionnaire. A firm’s managing partner is interviewed and asked to comment on his or her understanding of the firm’s significant quality control risks, new clients or industries with significant risk, the firm’s top three clients in terms of fees, how difficult client issues are resolved and partner advancement and compensation issues.
Relevant Ethical Requirements—SQCS No. 7 provides more detailed guidance on independence and requires a written confirmation of compliance with independence requirements from all firm personnel at least annually. In a nod to our continuing reliance on computer technology, the new standard allows the confirmation to be in paper or electronic format.
Client acceptance—Again, the new SQCS provides additional guidance on client acceptance and continuance issues. These additional details are requirements for policies that were always considered best practices and many firms had adopted them anyway, but the new standard leaves no doubt that these best practices are now requirements. The only new matter contemplated in this element is if firm personnel identify issues relating to acceptance or continuance, and the firm ultimately decides to accept or continue the client relationship, the firm must document how such issues were resolved.
Human resources—Except for providing specific policies, which are already a part of most firms’ quality control systems, this element did not change.
Firm personnel, especially those individuals in charge of quality control, should carefully review the new standard and determine what changes, if any, need to be made to the firm’s policies and procedures. Then each firm should write (or amend) their quality control document to incorporate the requirements of SQCS No. 7.
Marcia J. Hein, CPA is a past chair of the California Peer Review Committee, technical reviewer for the California peer review program and instructor on peer review for the California CPA Education Foundation. You can reach her at firstname.lastname@example.org.