Key Highlights of the ISQM 1, HKSQM 1 and HK Regulator’s 2023 Inspection Insights

Auditors play a crucial role in bolstering stakeholder confidence within capital markets, as accurate and reliable information is vital for informed decision-making. The introduction of the System of Quality Management (SQM) is pivotal for enhancing audit quality, ultimately driving long-term value creation for all stakeholders involved.
 
The ISQM 1 (International Standard on Quality Management 1), issued by the International Auditing and Assurance Standards Board (IAASB), is instrumental in setting the requirements for the CPA Firms to adopt an effective SQM. Both the ISQM 1 and Hong Kong Standard on Quality Management 1 (HKSQM 1) have been in effect since 15 December 2022. These standards mark a significant shift from the traditional quality control model to a more integrated quality management framework, providing a structured and formalized approach to quality management, which is proactive, risk-based, and scalable.
 
To comply with the requirements of the ISQM 1/ HKSQM 1, the CPA Firms (the Firms) must evaluate the effectiveness of their SQMs at least annually. These evaluations assess whether their SQMs provides reasonable assurance that the Firms and their people fulfil their responsibilities in accordance with professional standards and applicable legal and regulatory requirements, and engagements are being conducted in accordance with such standards and requirements, and engagement reports issued by the Firms or engagement partners are appropriate in the circumstances.

Key roles within the SQM:

• Ultimate responsibility and accountability for the SQM (Leadership)
• Operational responsibility for the SQM (Operational Lead)
• Operational responsibility for specific aspects of the SQM
  • For compliance with independence requirements
  • For the monitoring and remediation process

Key components of the SQM:

The Firm’s Risk Assessment Process

• Design & implement risk assessment process
• Establish quality objectives, identify & assess quality risks, and design & implement responses to address the quality risks
• Determine any additional quality objectives, risks or responses if there are changes in nature & circumstances

Governance and leadership

• Establish the right tone at the top to support the SQM
• Dedication to quality is embedded in the firm’s culture and reflected in their strategic decision & actions
• Reinforce the firm’s role in serving the public interest by consistently delivering quality engagements
• Emphasize professional ethics, values and attitudes
• Conduct periodic performance evaluations of leadership

Relevant ethical requirements

• Establish quality objectives to fulfil the relevant ethical requirements, including independence
• The firm & their personnel understand and fulfil the responsibilities relating to these relevant ethical requirements
• Others involved, such as network firms & service providers, also fulfil the responsibilities relating to the applicable ethical requirements

Client and Engagement Acceptance and Continuance

• Establish quality objectives for acceptance or continuance of clients and engagements
• Consider the firm’s capacity to deliver the engagement in compliance with professional standards & applicable regulatory requirements
• Consider the nature & circumstances of the engagement, including integrity and ethical values of the client
• The firm’s financial and operational priorities do not result in inappropriate decision

Engagement performance

• Establish quality objectives for engagement performance
• Engagement teams understand their responsibilities, particularly the overall responsibility of engagement partners
• Direction, supervision, and review work of engagement teams align with the engagement’s nature and circumstances, and resources assigned.
• Engagement teams exercise appropriate professional judgment and skepticism.
• Consultation on difficult or contentious matters, and the agreed conclusions reached.
• Any differing opinions within the team or with engagement quality reviewers should be raised to the firm, addressed, and resolved.
• Engagement documentation must be assembled promptly after the report date to comply with relevant ethical requirements or professional standards.

Resources

• Establish quality objectives for obtaining or developing, using, maintaining and assigning resources promptly to support the SQM.
• Resources include technological, intellectual, and human resources, as well as those from service providers.
• Resource needs, including financial resources, are planned, obtained, and allocated in a way that aligns with the firm’s commitment to perform quality engagements consistently

Information and communication

• Establish quality objectives for obtaining, generating, or using information and communicate information to support the SQM.
• The quality objectives highlight the two-way communication among firms, engagement teams, member firms, external parties, and service providers. This two-way communication is critical for the operation of the SQM and engagement performance.

Monitoring and Remediation Process

• The objectives are to provide relevant, reliable, and timely information regarding the design, implementation, and operation of the SQM, enabling the identification of deficiencies and the taking of appropriate actions to address identified deficiencies.
• In determining monitoring activities, various factors are to be considered, such as quality risk assessments, changes in the SQM, previous monitoring outcomes, external inspections, compliance complaints, and design of responses, risk assessment process, monitoring and remediation process.
• The firms must inspect at least one completed engagement for each engagement partner on a cyclical basis.
• Personnel involved in monitoring activities must be competence and objective.
• Findings are evaluated to identify deficiencies and assess the severity and pervasiveness of identified deficiencies through root cause analysis. Appropriate remedial actions are designed and implemented in response to the identified root causes.
• The individual assigned operational responsibility for the monitoring and remediation process evaluates the design, implementation and effectiveness of remedial actions. The individual must have ongoing communication with the leadership and operational lead of the SQM regarding monitoring activities performed, identified deficiencies and remedial actions.

The ISQM 1 and HKSQM 1 mandate a proactive, risk-based approach to managing quality, requiring firms to effectively design, implement and operate their SQMs. The risk-based approach is embedded into the requirements of these standards, which include establishing quality objectives, identifying and assessing risks to the achievement of the quality objectives, and designing and implementing responses to address the quality risks.
 
As we are now in 2025, this marks the third consecutive year that firms have been evaluating the effectiveness of their SQMs.  A recent report titled “Inspection Insights – Root Cause Analysis and Remediation: A Call to Action for Quality Improvement,” released by the Hong Kong Accounting and Financial Reporting Council (AFRC) on December 31, 2024, reveals that the quality of remediation plans submitted to the AFRC in response to their 2023 inspection generally did not meet expectations.
 
As the monitoring and remediation process of the SQM serves as a critical foundation for monitoring both the SQM and audit quality. It is essential for us to prioritize success and enhance the effectiveness of the SQMs to ensure robust quality management throughout our profession.