Section The Firm’s Risk Assessment Process (Ref: - Auditing Standard ASQM 1 Quality Management for Firms that Perform Audits or Reviews of Financial Reports and Other Financial Information, or Other Assurance or Related Services Engagements - The Firm’s Risk Assessment Process (Ref: Para. 23) | Zoe
Auditing Standard ASQM 1 Quality Management for Firms that Perform Audits or Reviews of Financial Reports and Other Financial Information, or Other Assurance or Related Services Engagements
The Firm’s Risk Assessment Process (Ref:The Firm’s Risk Assessment Process (Ref: Para. 23)
Start here
Get a plain-English read of The Firm’s Risk Assessment Process (Ref:
Turn the raw legal text into a practical explanation grounded in Auditing Standard ASQM 1 Quality Management for Firms that Perform Audits or Reviews of Financial Reports and Other Financial Information, or Other Assurance or Related Services Engagements.
The Firm’s Risk Assessment Process (Ref: Para. 23)
How the firm designs the firm’s risk assessment process may be affected by the nature and circumstances of the firm, including how the firm is structured and organised.
Scalability examples to demonstrate how the firm’s risk assessment process may differ In a less complex firm, the individual(s) assigned operational responsibility for the system of quality management may have a sufficient understanding of the firm and its engagements to undertake the risk assessment process. Furthermore, the documentation of the quality objectives, quality risks and responses may be less extensive than for a more complex firm (e.g., it may be documented in a single document). In a more complex firm, there may be a formal risk assessment process, involving multiple individuals and numerous activities. The process may be centralized (e.g., the quality objectives, quality risks and responses are established centrally for all business units, functions and service lines) or decentralized (e.g., the quality objectives, quality risks and responses are established at a business unit, function or service line level, with the outputs combined at the firm level). The firm’s network may also provide the firm with quality objectives, quality risks and responses to be included in the firm’s system of quality management.
The process of establishing quality objectives, identifying and assessing quality risks and designing and implementing responses is iterative, and the requirements of this ASQM are not intended to be addressed in a linear manner. For example:
In identifying and assessing quality risks, the firm may determine that an additional quality objective(s) needs to be established.
When designing and implementing responses, the firm may determine that a quality risk was not identified and assessed.
Information sources that enable the firm to establish quality objectives, identify and assess quality risks and design and implement responses form part of the firm’s information and communication component and include:
The results of the firm’s monitoring and remediation process (see paragraphs 42 and A171).
Information from the network or service providers, including:
o Information about network requirements or network services (see paragraph 48); and
o Other information from the network, including information about the results of monitoring activities undertaken by the network across the network firms (see paragraphs 50–51).
Other information, both internal or external, may also be relevant to the firm’s risk assessment process, such as:
Information regarding complaints and allegations about failures to perform work in accordance with AUASB standards and applicable legal and regulatory requirements, or non-compliance with the firm’s policies or procedures established in accordance with this ASQM.
The results of external inspections.
Information from regulators about the entities for whom the firm performs engagements which is made available to the firm, such as information from a securities regulator about an entity for whom the firm performs engagements (e.g., irregularities in the entity’s financial report or non-compliance with securities regulation).
Changes in the system of quality management that affect other aspects of the system, for example, changes in the firm’s resources.
Other external sources, such as regulatory actions and litigation against the firm or other firms in the jurisdiction that may highlight areas for the firm to consider.
Establish Quality Objectives (Ref: Para. 24)
Law, regulation or AUASB standards may establish requirements that give rise to additional quality objectives. For example, a firm may be required by law or regulation to appoint non-executive individuals to the firm’s governance structure and the firm considers it necessary to establish additional quality objectives to address the requirements.
The nature and circumstances of the firm and its engagements may be such that the firm may not find it necessary to establish additional quality objectives.
The firm may establish sub-objectives to enhance the firm’s identification and assessment of quality risks, and design and implementation of responses.
Identify and Assess Quality Risks (Ref: Para. 25)
There may be other conditions, events, circumstances, actions or inactions not described in paragraph 25(a) that may adversely affect the achievement of a quality objective.
A risk arises from how, and the degree to which, a condition, event, circumstance, action or inaction may adversely affect the achievement of a quality objective. Not all risks meet the definition of a quality risk. Professional judgement assists the firm in determining whether a risk is a quality risk, which is based on the firm’s consideration of whether there is a reasonable possibility of the risk occurring, and individually, or in combination with other risks, adversely affecting the achievement of one or more quality objectives.
Examples of the firm’s understanding of the conditions, events, circumstances, actions or inactions that may adversely affect the achievement of the quality objectives
Examples of quality risks that may arise
The strategic and operational decisions and actions, business processes and business model of the firm: The firm’s overall financial goals are overly dependent on the extent of services provided by the firm not within the scope of this ASQM.
In the context of governance and leadership, this may give rise to a number of quality risks such as: Resources are allocated or assigned in a manner that prioritizes the services not within the scope of this ASQM and may negatively affect the quality of engagements within the scope of this ASQM. Decisions about financial and operational priorities do not fully or adequately consider the importance of quality in the performance of engagements within the scope of this ASQM.
The characteristics and management style of leadership: The firm is a smaller firm with a few engagement partners with shared authority.
In the context of governance and leadership, this may give rise to a number of quality risks such as: Leadership’s responsibilities and accountability for quality are not clearly defined and assigned. The actions and behaviours of leadership that do not promote quality are not questioned.
The complexity and operating characteristics of the firm: The firm has recently completed a merger with another firm.
In the context of resources, this may give rise to a number of quality risks including: Technological resources used by the two merged firms may be incompatible. Engagement teams may use intellectual resources developed by a firm prior to the merger, which are no longer consistent with the new methodology being used by the new merged firm.
Given the evolving nature of the system of quality management, the responses designed and implemented by the firm may give rise to conditions, events, circumstances, actions or inactions that result in further quality risks. For example, the firm may implement a resource (e.g., a technological resource) to address a quality risk, and quality risks may arise from the use of such resource.
The degree to which a risk, individually, or in combination with other risks may adversely affect the achievement of a quality objective(s) may vary based on the conditions, events, circumstances, actions or inactions giving rise to the risk, taking into account, for example:
How the condition, event, circumstance, action or inaction would affect the achievement of the quality objective.
How frequently the condition, event, circumstance, action or inaction is expected to occur.
How long it would take after the condition, event, circumstance, action or inaction occurred for it to have an effect, and whether in that time the firm would have an opportunity to respond to mitigate the effect of the condition, event, circumstance, action or inaction.
How long the condition, event, circumstance, action or inaction would affect the achievement of the quality objective once it has occurred.
The assessment of quality risks need not comprise formal ratings or scores, although firms are not precluded from using them.
Design and Implement Responses to Address the Quality Risks (Ref: Para. 16(u), 26)
The nature, timing and extent of the responses are based on the reasons for the assessment given to the quality risks, which is the considered occurrence and effect on the achievement of one or more quality objectives.
The responses designed and implemented by the firm may operate at the firm level or engagement level, or there may be a combination of responsibilities for actions to be taken at the firm and engagement level.
Example of a response designed and implemented by the firm that operates at both the firm and engagement levelThe firm establishes policies or procedures for consultation which include with whom consultation should be undertaken by engagement teams and the specific matters for which consultation is required. The firm appoints suitably qualified and experienced individuals to provide the consultations. The engagement team is responsible for identifying when matters for consultation occur and initiating consultation, and implementing the conclusions from consultation.[12]
The need for formally documented policies or procedures may be greater for firms that have many personnel or that are geographically dispersed, in order to achieve consistency across the firm.
Changes in the Nature and Circumstances of the Firm or its Engagements (Ref: Para. 27)
Scalability example to demonstrate how policies or procedures for identifying information about changes in the nature and circumstances of the firm and its engagements may vary In a less complex firm, the firm may have informal policies or procedures to identify information about changes in the nature and circumstances of the firm or its engagements, particularly when the individual(s) responsible for establishing quality objectives, identifying and assessing quality risks and designing and implementing responses is able to identify such information in the normal course of their activities. In a more complex firm, the firm may need to establish more formal policies or procedures to identify and consider information about changes in the nature and circumstances of the firm or its engagements. This may include, for example, a periodic review of information relating to the nature and circumstances of the firm and its engagements, including ongoing tracking of trends and occurrences in the firm’s internal and external environment.
Additional quality objectives may need to be established, or quality risks and responses added to or modified, as part of the remedial actions undertaken by the firm to address an identified deficiency in accordance with paragraph 42.
The firm may have established quality objectives in addition to those specified by this ASQM. The firm may also identify information that indicates that additional quality objectives already established by the firm are no longer needed, or need to be modified.