Devil's in the Details

California CPA magazine: September 2008

SQCS No. 7: A Firm's System of Quality Control

In Oct. 10, 2007, the AICPA Auditing Standards Board issued Statement on Quality Control Standards (SQCS) No. 7, A Firm’s System of Quality Control, to replace all existing SQCS. The SQCS, which is effective Jan. 1, 2009, deals with a firm’s quality control practices in the areas of audits, reviews, compilations and other attestation engagements. It also places an unconditional obligation on a firm to establish a system of quality control that is designed to provide reasonable assurance that a firm and its personnel comply with professional standards and applicable regulatory and legal requirements, and that the reports issued by the firm or engagement partners are appropriate in the circumstances.

The objectives of SQCS No. 7 are not really different from previous quality control standards. The devil, however, is in the details. The new standard expands current standards and provides guidance consistent with international standards, particularly International Standard on Quality Control (ISQC) 1, Quality Control for Audit, Assurance and Related Services.

A Brief Reminder of Current SQCS
Like all professional standards (FASBs, SASs, SSARs, etc.), the SQCS apply to all CPAs and their firms. Just because these standards are tested only in firms having a system peer review does not mean that they do not apply to everyone else.

Current standards:
•    Provide a general overview of a system of quality control.
•    Establish five elements of quality control.
•    Provide guidance for establishing policies and procedures for each of the quality control elements.
•    Discuss techniques to administer a quality control system, such as assignment of responsibilities, communication and documentation of both the design and compliance with the quality control system.

The five elements of quality control are:
1)    Independence, Integrity and Objectivity
2)    Personnel Management
3)    Acceptance and Continuance of Clients and Engagements
4)    Engagement Performance
5.    Monitoring

Policies and procedures are developed for each of the five elements. The type and number of policies is dependent on many factors, including the firm’s size, structure, etc. Policies may be memorializedin a formal document, or they may be informal and communicated to the appropriate parties verbally.

How is SQCS No. 7 Different?
First and foremost, SQCS No. 7 is far more detailed than current standards. Right after the introduction and definition of a system of quality control are definitions of several terms, such as “accounting and auditing practice,” “engagement documentation” and “engagement team.” These definitions are consistent with the definitions for these terms throughout other standards. 

Engagement Quality Control Review
One definition, however, stands out. According to SQCS No. 7, an “engagement quality control review” is “a process designed to provide an objective evaluation, by an individual or individuals who are not members of the engagement team, of the significant judgments the engagement team made and the conclusions they reached in formulating the report.”

This review is often referred to as a concurring review. The engagement quality control review occurs before the report is issued. Firms must identify which engagements are to be subject to such a review. In addition, SQCS No. 7 provides guidance on how such a review should be performed. Procedures to be performed in an engagement quality control review include:

•    Review of the financial statements and report and consider whether the report is appropriate under the circumstances.
•    Review of selected working papers relating to significant engagement team judgments.
•    Discuss the engagement with the practitioner-in-charge.

The extent of such a review depends on the complexity of the engagement, and the risk that the report might not be appropriate in the circumstances. And, of course, the results of an engagement quality control review must be documented, specifically stating that the firm’s procedures have been performed, the review was completed before the report was issued and the reviewer is not aware of any unresolved matters.

The new statement also requires firms to establish criteria for the eligibility of engagement quality control reviewers, including technical expertise, objectivity and the proper authority. Qualified persons from outside the firm may be contracted when sole practitioners or small firms identify an engagement requiring an engagement quality control review.

It should be noted that engagement quality control reviews are not required by the new standard. SQCS No. 7 simply states that policies and procedures for such a review should be documented for those firms that have incorporated concurring reviews into their systems of quality control.

Documentation
A firm must document its quality control policies and procedures. The extent of the documentation is based on the size, structure and nature of the firm’s practice.
This requirement will be a big change for many small firms that have policies and procedures, but have not formally documented them. During peer review, small firms generally complete a questionnaire for their peer reviewer that answers specific questions about policies and procedures.

Firms still may be able to use this document as a quality control document, as long it is completed by Jan. 1, 2009, periodically reviewed and updated and given to each employee. Simply download the appropriate Quality Control Policies and Procedures Questionnaire (http://aicpa.org/members/div/practmon/systemreview.asp), complete it and give a copy to each member of the firm. Then, annually, update the form for any changes.

Samples of more formalized documents can be found in the AICPA practice aid Establishing and Maintaining a System of Quality Control for a CPA Firm’s Accounting and Auditing Practice (Product No. 006636). It contains sample quality control documents for a firm with multiple offices, a firm with a single office, a sole practitioner and an alternative practice structure. Practitioners Publishing Company has updated its QC Manual as well, and introduced a streamlined version for firms that only do compilation and review work. 

A warning to firms preparing to document their quality control system for the first time: be careful to adopt only those policies and procedures that work for your firm. Adoption of a sample quality control document from the AICPA or Practitioners Publishing Company without modification can have disastrous results during peer review if the firm does not have the resources to comply with the policies and procedures adopted.

Elements of Quality Control
The elements of quality control have been expanded as follows:

•    Leadership responsibilities for quality within the firm (tone at the top)
•    Relevant ethical requirements
•    Acceptance and continuance of client relationships and specific engagements
•    Human resources (formerly personnel management)
•    Engagement performance
•    Monitoring.

Tone at the top—The firm’s managing partner (or equivalent) should assume ultimate responsibility for quality control by providing leadership and setting an example that promotes a quality-oriented firm culture. To that end, the firm’s quality control system should include policies to:

•    Assign management responsibilities so that commercial considerations do not override the quality of work performed.
•    Design its policies and procedures addressing performance evaluation, compensation and promotion (including incentive systems) with regard to its personnel to demonstrate the firm’s overarching commitment to objectives of the system of quality control.
•    Devote sufficient and appropriate resources for the development, communication and support of its quality control policies and procedures.

Peer review has been moving in this direction for several years. The Center for Public Company Audit Firms Peer Review Program established a managing partner questionnaire several years ago, and the AICPA Peer Review Program adopted a similar questionnaire. A firm’s managing partner is interviewed and asked to comment on his or her understanding of the firm’s significant quality control risks, new clients or industries with significant risk, the firm’s top three clients in terms of fees, how difficult client issues are resolved and partner advancement and compensation issues.

Relevant Ethical Requirements—SQCS No. 7 provides more detailed guidance on independence and requires a written confirmation of compliance with independence requirements from all firm personnel at least annually. In a nod to our continuing reliance on computer technology, the new standard allows the confirmation to be in paper or electronic format.

Client acceptance—Again, the new SQCS provides additional guidance on client acceptance and continuance issues. These additional details are requirements for policies that were always considered best practices and many firms had adopted them anyway, but the new standard leaves no doubt that these best practices are now requirements. The only new matter contemplated in this element is if firm personnel identify issues relating to acceptance or continuance, and the firm ultimately decides to accept or continue the client relationship, the firm must document how such issues were resolved.

Human resources—Except for providing specific policies, which are already a part of most firms’ quality control systems, this element did not change.
Engagement performance—The new SQCS provides more detailed guidance on engagement supervision and review, including a requirement that more experienced team members review the work of those with less experience. In addition, a section has been added concerning retention of engagement documentation. This section discusses establishing policies and procedures to maintain the confidentiality, safe custody, integrity, accessibility and retrievability of engagement documentation. These policies and procedures are consistent with the requirements of SAS 103. Specific guidance is also given regarding consultation policies and procedures. Finally, there is a requirement that a report cannot be issued until any differences of opinion have been resolved.
Monitoring—While the new standard still allows individuals to review their own work, it discourages firms from doing so. And, like all the other elements, much additional guidance on how to conduct monitoring has been added. A section regarding complaints and allegations also has been added to the monitoring section. This would include policies and procedures to handle complaints and allegations the work was not performed in accordance with standards or regulatory and legal requirements that might come from outsiders or from firm personnel.

Firm personnel, especially those individuals in charge of quality control, should carefully review the new standard and determine what changes, if any, need to be made to the firm’s policies and procedures. Then each firm should write (or amend) their quality control document to incorporate the requirements of SQCS No. 7.
Use of practice aids from the AICPA or Practitioners Publishing Company are encouraged, but only adopt those policies and procedures that the firm can implement. 

Marcia J. Hein, CPA is a past chair of the California Peer Review Committee, technical reviewer for the California peer review program and instructor on peer review for the California CPA Education Foundation. You can reach her at marcia@mjh-cpa.com.