Auditing Standard ASQM 1 Quality Management for Firms that Perform Audits or Reviews of Financial Reports and Other Financial Information, or Other Assurance or Related Services Engagements
Monitoring and Remediation Process (Ref:Monitoring and Remediation Process (Ref: Para. 35—47)
Start here
Get a plain-English read of Monitoring and Remediation Process (Ref:
Turn the raw legal text into a practical explanation grounded in Auditing Standard ASQM 1 Quality Management for Firms that Perform Audits or Reviews of Financial Reports and Other Financial Information, or Other Assurance or Related Services Engagements.
Monitoring and Remediation Process (Ref: Para. 35–47)
In addition to enabling the evaluation of the system of quality management, the monitoring and remediation process facilitates the proactive and continual improvement of engagement quality and the system of quality management. For example:
Given the inherent limitations of a system of quality management, the firm’s identification of deficiencies is not unusual and it is an important aspect of the system of quality management, because prompt identification of deficiencies enables the firm to remediate them in a timely and effective manner, and contributes to a culture of continual improvement.
The monitoring activities may provide information that enables the firm to prevent a deficiency through responding to a finding that could, over a period of time, lead to a deficiency.
Designing and Performing Monitoring Activities (Ref: Para. 37–38)
The firm’s monitoring activities may comprise a combination of ongoing monitoring activities and periodic monitoring activities. Ongoing monitoring activities are generally routine activities, built into the firm’s processes and performed on a real-time basis, reacting to changing conditions. Periodic monitoring activities are conducted at certain intervals by the firm. In most cases, ongoing monitoring activities provide information about the system of quality management in a timelier manner.
Monitoring activities may include the inspection of in-process engagements. Inspections of engagements are designed to monitor that an aspect of the system of quality management is designed, implemented and operating in the manner intended. In some circumstances, the system of quality management may include responses that are designed to review engagements while they are in the process of being performed that appear similar in nature to an inspection of in-process engagements (e.g., reviews that are designed to detect failures or shortcomings in the system of quality management so that they can prevent a quality risk from occurring). The purpose of the activity will guide its design and implementation, and where it fits within the system of quality management (i.e., whether it is an inspection of an in-process engagement that is a monitoring activity or a review of an engagement that is a response to address a quality risk).
The nature, timing and extent of the monitoring activities may also be affected by other matters, including:
The size, structure and organisation of the firm.
The involvement of the firm’s network in monitoring activities.
The resources that the firm intends to use to enable monitoring activities, such as the use of IT applications.
Section Monitoring and Remediation Process (Ref: - Auditing Standard ASQM 1 Quality Management for Firms that Perform Audits or Reviews of Financial Reports and Other Financial Information, or Other Assurance or Related Services Engagements - Monitoring and Remediation Process (Ref: Para. 35—47) | Zoe
When performing monitoring activities, the firm may determine that changes to the nature, timing and extent of the monitoring activities are needed, such as when findings indicate the need for more extensive monitoring activities.
The Design of the Firm’s Risk Assessment Process and Monitoring and Remediation Process (Ref: Para. 37(c))
How the firm’s risk assessment process is designed (e.g., a centralised or decentralised process, or the frequency of review) may affect the nature, timing and extent of the monitoring activities, including monitoring activities over the firm’s risk assessment process.
How the firm’s monitoring and remediation process is designed (i.e., the nature, timing and extent of the monitoring and remediation activities, taking into account the nature and circumstances of the firm) may affect the monitoring activities undertaken by the firm to determine whether the monitoring and remediation process is achieving the intended purpose as described in paragraph 35.
Scalability example to demonstrate the monitoring activities for the monitoring and remediation process In a less complex firm, the monitoring activities may be simple, since information about the monitoring and remediation process may be readily available in the form of leadership’s knowledge, based on their frequent interaction with the system of quality management, of the nature, timing and extent of the monitoring activities undertaken, the results of the monitoring activities, and the firm’s actions to address the results. In a more complex firm, the monitoring activities for the monitoring and remediation process may be specifically designed to determine that the monitoring and remediation process is providing relevant, reliable and timely information about the system of quality management, and responding appropriately to identified deficiencies.
Changes in the System of Quality Management (Ref: Para. 37(d))
Changes in the system of quality management may include:
Changes to address an identified deficiency in the system of quality management.
Changes to the quality objectives, quality risks or responses as a result of changes in the nature and circumstances of the firm and its engagements.
When changes occur, previous monitoring activities undertaken by the firm may no longer provide the firm with information to support the evaluation of the system of quality management and, therefore, the firm’s monitoring activities may include monitoring of those areas of change.
Previous Monitoring Activities (Ref: Para. 37(e))
The results of the firm’s previous monitoring activities may indicate areas of the system where a deficiency may arise, particularly areas where there is a history of identified deficiencies.
Previous monitoring activities undertaken by the firm may no longer provide the firm with information to support the evaluation of the system, including on areas of the system of quality management that have not changed, particularly when time has elapsed since the monitoring activities were undertaken.
Other Relevant Information (Ref: Para. 37(f))
In addition to the sources of information indicated in paragraph 37(f), other relevant information may include:
Information communicated by the firm’s network in accordance with paragraphs 50(c) and 51(b) about the firm’s system of quality management, including the network requirements or network services that the firm has included in its system of quality management.
Information communicated by a service provider about the resources the firm uses in its system of quality management.
Information from regulators about the entities for whom the firm performs engagements, which is made available to the firm, such as information from a securities regulator about an entity for whom the firm performs engagements (e.g., irregularities in the entity’s financial report).
The results of external inspections or other relevant information, both internal and external, may indicate that previous monitoring activities undertaken by the firm failed to identify a deficiency in the system of quality management. This information may affect the firm’s consideration of the nature, timing and extent of the monitoring activities.
External inspections are not a substitute for the firm’s internal monitoring activities. Nevertheless, the results of external inspections inform the nature, timing and extent of the monitoring activities.
Engagement Inspections (Ref: Para. 38)
Examples of matters in paragraph 37 that may be considered by the firm in selecting completed engagements for inspection In relation to the conditions, events, circumstances, actions or inactions giving rise to the quality risks:o The types of engagements performed by the firm, and the extent of the firm’s experience in performing the type of engagement.o The types of entities for which engagements are undertaken, for example: Entities that are listed. Entities operating in emerging industries. Entities operating in industries associated with a high level of complexity or judgement. Entities operating in an industry that is new to the firm.o The tenure and experience of engagement partners. The results of previous inspections of completed engagements, including for each engagement partner. In relation to other relevant information:o Complaints or allegations about an engagement partner.o The results of external inspections, including for each engagement partner.o The results of the firm’s evaluation of each engagement partner’s commitment to quality.
The firm may undertake multiple monitoring activities, other than inspection of completed engagements, that focus on determining whether engagements have complied with policies or procedures. These monitoring activities may be undertaken on certain engagements or engagement partners. The nature and extent of these monitoring activities, and the results, may be used by the firm in determining:
Which completed engagements to select for inspection;
Which engagement partners to select for inspection;
How frequently to select an engagement partner for inspection; or
Which aspects of the engagement to consider when performing the inspection of completed engagements.
The inspection of completed engagements for engagement partners on a cyclical basis may assist the firm in monitoring whether engagement partners have fulfilled their overall responsibility for managing and achieving quality on the engagements they are assigned to.
Example of how a firm may apply a cyclical basis for the inspection of completed engagements for each engagement partnerThe firm may establish policies or procedures addressing the inspection of completed engagements that: Set forth the standard period of the inspection cycle, such as the inspection of a completed engagement for each engagement partner performing audits of financial reports once every three years, and for all other engagement partners, once every five years; Set out the criteria for selecting completed engagements, including that for an engagement partner performing audits of financial reports, the engagement(s) selected include an audit engagement; Address selecting engagement partners in a manner that is unpredictable; and Address when it is necessary or appropriate to select engagement partners more, or less, frequently than the standard period set out in the policy, for example:o The firm may select engagement partners more frequently than the standard period set out in the firm’s policy when: Multiple deficiencies have been identified by the firm that have been evaluated as severe, and the firm determines that a more frequent cyclical inspection is needed across all engagement partners. The engagement partner performs engagements for entities operating in a certain industry where there are high levels of complexity or judgement. An engagement performed by the engagement partner has been subject to other monitoring activities, and the results of the other monitoring activities were unsatisfactory. The engagement partner has performed an engagement for an entity operating in an industry in which the engagement partner has limited experience. The engagement partner is a newly appointed engagement partner, or has recently joined the firm from another firm or another jurisdiction.o The firm may defer the selection of the engagement partner (e.g., deferring for a year beyond the standard period set out in the firm’s policy) when: Engagements performed by the engagement partner have been subject to other monitoring activities during the standard period set out in the firm’s policy; and The results of the other monitoring activities provide sufficient information about the engagement partner (i.e., performing the inspection of completed engagements would unlikely provide the firm with further information about the engagement partner).
The matters considered in an inspection of an engagement depend on how the inspection will be used to monitor the system of quality management. Ordinarily, the inspection of an engagement includes determining that responses that are implemented at the engagement level (e.g., the firm’s policies and procedures in respect of engagement performance), have been implemented as designed and are operating effectively.
Individuals Performing the Monitoring Activities (Ref: Para. 39(b))
The provisions of relevant ethical requirements are relevant in designing the policies or procedures addressing the objectivity of the individuals performing the monitoring activities. A self-review threat may arise when an individual who performs:
An inspection of an engagement was:
In the case of an audit of a financial report, an engagement team member or the engagement quality reviewer of that engagement or an engagement for a subsequent financial period; or
For all other engagements, an engagement team member or the engagement quality reviewer of that engagement.
Another type of monitoring activity had participated in designing, executing or operating the response being monitored.
In some circumstances, for example, in the case of a less complex firm, there may not be personnel who have the competence, capabilities, time or objectivity to perform the monitoring activities. In these circumstances, the firm may use network services or a service provider to perform the monitoring activities.
Evaluating Findings and Identifying Deficiencies (Ref: Para. 16(a), 40–41)
The firm accumulates findings from the performance of monitoring activities, external inspections and other relevant sources.
Information accumulated by the firm from the monitoring activities, external inspections and other relevant sources may reveal other observations about the firm’s system of quality management, such as:
Actions, behaviours or conditions that have given rise to positive outcomes in the context of quality or the effectiveness of the system of quality management; or
Similar circumstances where no findings were noted (e.g., engagements where no findings were noted, and the engagements have a similar nature to the engagements where findings were noted).
Other observations may be useful to the firm as they may assist the firm in investigating the root cause(s) of identified deficiencies, indicate practices that the firm can support or apply more extensively (e.g., across all engagements) or highlight opportunities for the firm to enhance the system of quality management.
The firm exercises professional judgement in determining whether findings, individually or in combination with other findings give rise to a deficiency in the system of quality management. In making the judgement, the firm may need to take into account the relative importance of the findings in the context of the quality objectives, quality risks, responses or other aspects of the system of quality management to which they relate. The firm’s judgements may be affected by quantitative and qualitative factors relevant to the findings. In some circumstances, the firm may determine it appropriate to obtain more information about the findings in order to determine whether a deficiency exists. Not all findings, including engagement findings, will be a deficiency.
Examples of quantitative and qualitative factors that a firm may consider in determining whether findings give rise to a deficiencyQuality Risks and Responses If the findings relate to a response:o How the response is designed, for example, the nature of the response, the frequency of its occurrence (if applicable), and the relative importance of the response to addressing the quality risk(s) and achieving the quality objective(s) to which it relates.o The nature of the quality risk to which the response relates, and the extent to which the findings indicate that the quality risk has not been addressed.o Whether there are other responses that address the same quality risk and whether there are findings for those responses.Nature of the Findings and Their Pervasiveness The nature of the findings. For example, findings related to leadership actions and behaviours may be qualitatively significant, given the pervasive effect this could have on the system of quality management as a whole. Whether the findings, in combination with other findings, indicate a trend or systemic issue. For example, similar engagement findings that appear on multiple engagements may indicate a systemic issue.Extent of Monitoring Activity and Extent of Findings The extent of the monitoring activity from which the findings arose, including the number or size of the selections. The extent of the findings in relation to the selection covered by the monitoring activity, and in relation to the expected deviation rate. For example, in the case of inspection of engagements, the number of engagements selected where the findings were identified, relative to the total number of engagements selected, and the expected deviation rate set by the firm.
Evaluating findings and identifying deficiencies and evaluating the severity and pervasiveness of an identified deficiency, including investigating the root cause(s) of an identified deficiency, are part of an iterative and non-linear process.
Examples of how the process of evaluating findings and identifying deficiencies, evaluating identified deficiencies, including investigating the root cause(s) of identified deficiencies, is iterative and non-linear In investigating the root cause(s) of an identified deficiency, the firm may identify a circumstance that has similarities to other circumstances where there were findings that were not considered a deficiency. As a result, the firm adjusts its evaluation of the other findings and classifies them as a deficiency. In evaluating the severity and pervasiveness of an identified deficiency, the firm may identify a trend or systemic issue that correlates with other findings that are not considered deficiencies. As a result, the firm adjusts its evaluation of the other findings and also classifies them as deficiencies.
The results of monitoring activities, results of external inspections and other relevant information (e.g., network monitoring activities or complaints and allegations) may reveal information about the effectiveness of the monitoring and remediation process. For example, the results of external inspections may provide information about the system of quality management that has not been identified by the firm’s monitoring and remediation process, which may highlight a deficiency in that process.
Factors the firm may consider in evaluating the severity and pervasiveness of an identified deficiency include:
The nature of the identified deficiency, including the aspect of the firm’s system of quality management to which the deficiency relates, and whether the deficiency is in the design, implementation or operation of the system of quality management;
In the case of identified deficiencies related to responses, whether there are compensating responses to address the quality risk to which the response relates;
The root cause(s) of the identified deficiency;
The frequency with which the matter giving rise to the identified deficiency occurred; and
The magnitude of the identified deficiency, how quickly it occurred and the duration of time that it existed and had an effect on the system of quality management.
The severity and pervasiveness of identified deficiencies affects the evaluation of the system of quality management that is undertaken by the individual(s) assigned ultimate responsibility and accountability for the system of quality management.
Root Cause of the Identified Deficiencies (Ref: Para. 41(a))
The objective of investigating the root cause(s) of identified deficiencies is to understand the underlying circumstances that caused the deficiencies to enable the firm to:
Evaluate the severity and pervasiveness of the identified deficiency; and
Appropriately remediate the identified deficiency.
Performing a root cause analysis involves those performing the assessment exercising professional judgement based on the evidence available.
The nature, timing and extent of the procedures undertaken to understand the root cause(s) of an identified deficiency may also be affected by the nature and circumstances of the firm, such as:
The complexity and operating characteristics of the firm.
The size of the firm.
The geographical dispersion of the firm.
How the firm is structured or the extent to which the firm concentrates or centralizes its processes or activities.
Examples of how the nature of identified deficiencies and their possible severity and the nature and circumstances of the firm may affect the nature, timing and extent of the procedures to understand the root cause(s) of the identified deficiencies The nature of the identified deficiency: The firm’s procedures to understand the root cause(s) of an identified deficiency may be more rigorous in circumstances when an engagement report related to an audit of a financial report of a listed entity was issued that was inappropriate or the identified deficiency relates to leadership’s actions and behaviours regarding quality. The possible severity of the identified deficiency: The firm’s procedures to understand the root cause(s) of an identified deficiency may be more rigorous in circumstances when the deficiency has been identified across multiple engagements or there is an indication that policies or procedures have high rates of non-compliance. Nature and circumstances of the firm:o In the case of a less complex firm with a single location, the firm’s procedures to understand the root cause(s) of an identified deficiency may be simple, since the information to inform the understanding may be readily available and concentrated, and the root cause(s) may be more apparent.o In the case of a more complex firm with multiple locations, the procedures to understand the root cause(s) of an identified deficiency may include using individuals specifically trained on investigating the root cause(s) of identified deficiencies, and developing a methodology with more formalised procedures for identifying root cause(s).
In investigating the root cause(s) of identified deficiencies, the firm may consider why deficiencies did not arise in other circumstances that are of a similar nature to the matter to which the identified deficiency relates. Such information may also be useful in determining how to remediate an identified deficiency.
Example of when a deficiency did not arise in other circumstances of a similar nature, and how this information assists the firm in investigating the root cause(s) of identified deficienciesThe firm may determine that a deficiency exists because similar findings have occurred across multiple engagements. However, the findings have not occurred in several other engagements within the same population being tested. By contrasting the engagements, the firm concludes that the root cause of the identified deficiency is a lack of appropriate involvement by the engagement partners at key stages of the engagements.
Identifying a root cause(s) that is appropriately specific may support the firm’s process for remediating identified deficiencies.
Example of identifying a root cause(s) that is appropriately specificThe firm may identify that engagement teams performing audits of financial reports are failing to obtain sufficient appropriate audit evidence on accounting estimates where management’s assumptions have a high degree of subjectivity. While the firm notes that these engagement teams are not exercising appropriate professional scepticism, the underlying root cause of this issue may relate to another matter, such as a cultural environment that does not encourage engagement team members to question individuals with greater authority or insufficient direction, supervision and review of the work performed on the engagements.
In addition to investigating the root cause(s) of identified deficiencies, the firm may also investigate the root cause(s) of positive outcomes as doing so may reveal opportunities for the firm to improve, or further enhance, the system of quality management.
Responding to Identified Deficiencies (Ref: Para. 42)
The nature, timing and extent of remedial actions may depend on a variety of other factors, including:
The root cause(s).
The severity and pervasiveness of the identified deficiency and therefore the urgency with which it needs to be addressed.
The effectiveness of the remedial actions in addressing the root cause(s), such as whether the firm needs to implement more than one remedial action in order to effectively address the root cause(s), or needs to implement remedial actions as interim measures until the firm is able to implement more effective remedial actions.
In some circumstances, the remedial action may include establishing additional quality objectives, or quality risks or responses may be added or modified, because it is determined that they are not appropriate.
In circumstances when the firm determines that the root cause of an identified deficiency relates to a resource provided by a service provider, the firm may also:
Consider whether to continue using the resource provided by the service provider.
Communicate the matter to the service provider.
The firm is responsible for addressing the effect of the identified deficiency related to a resource provided by a service provider on the system of quality management and taking action to prevent the deficiency from recurring with respect to the firm’s system of quality management. However, the firm is not ordinarily responsible for remediating the identified deficiency on behalf of the service provider or further investigating the root cause of the identified deficiency at the service provider.
Findings About a Particular Engagement (Ref: Para. 45)
In circumstances when procedures were omitted or the report issued is inappropriate, the action taken by the firm may include:
Consulting with appropriate individuals regarding the appropriate action.
Discussing the matter with management of the entity or those charged with governance.
Performing the omitted procedures.
The actions taken by the firm do not relieve the firm of the responsibility to take further actions relating to the finding in the context of the system of quality management, including evaluating the findings to identify deficiencies and when a deficiency exists, investigating the root cause(s) of the identified deficiency.
Ongoing Communication Related to the Monitoring and Remediation (Ref: Para. 46)
The information communicated about the monitoring and remediation to the individual(s) assigned ultimate responsibility and accountability for the system of quality management may be communicated on an ongoing basis or periodically. The individual(s) may use the information in multiple ways, for example:
As a basis for further communications to personnel about the importance of quality.
To hold individuals accountable for their roles assigned to them.
To identify key concerns about the system of quality management in a timely manner.
The information also provides a basis for the evaluation of the system of quality management, and conclusion thereon, as required by paragraphs 53–54.