Quality Control Standards Revisited

By James Schmutte and John R. Thieling

The AICPA practice monitoring programs indicated a change was needed for the existing quality control standards. One new standard expands the coverage of the standards and replaces the nine present elements with five broader elements. Another standard provides guidance to firms on implementing the new monitoring element.

The AICPA Code of Professional Conduct stipulates that members should practice in firms that have in place a system of quality control to ensure that services are competently delivered and adequately supervised. The purpose of a quality-control system is to provide the firm with reasonable assurance it is meeting professional standards. Statement on Quality Control Standards No.1 (SQCS No. 1) was issued in 1979 to give guidance related to quality control and the accounting and auditing services provided by a CPA firm.

While most professional standards (SASs, SSARSs, etc.) are engagement oriented, SQCS No. 1 focused on the firm's accounting and auditing practice as a whole. SQCS No. 1 served as the benchmark or standard for the AICPA's external peer and quality review programs. The similarity in the AICPA's programs was such that in the fall of 1994, the peer review program of the Private Companies Practice Section of the AICPA Division for CPA Firms and the AICPA Quality Review Program merged.

New Quality Control Standards

The Auditing Standards Board (ASB) has issued two new SQCSs to replace SQCS No. 1. The ASB's decision to reconsider the existing quality control standard was influenced by the collective experiences of the AICPA's practice-monitoring programs. The new standards are based on the recommendations of a joint task force that included representatives of the AICPA's practice monitoring committees as well as the management consulting, tax, and financial planning executive committees. The task force concluded the existing quality-control standard did not adequately address current accounting and auditing services, the narrowly defined control elements did not recognize the diversity in practice and impeded practice-monitoring efforts, and practitioners were often
confused as to the applicability and implementation of certain control elements. The system of quality control described in the new standards is required only for a firm's accounting and auditing practice.

SQCS No. 2

SQCS No. 2 makes two major changes. First, it expands the definition of a firm's accounting and auditing practice to include all audit, attest, and accounting and review services for which professional standards have been established by the Auditing Standards Board or the Accounting and Review Services Committee under rules 201 and 202 of the AICPA Code of Professional Conduct. The expanded definition of a firm's accounting and auditing practice includes engagements performed under Statements on Standards for Attestation Engagements that were not covered under SQCS No. 1.

Second, SQCS No. 2 replaces the nine specific quality control elements discussed in SQCS No. 1 with five broad elements that focus on the functional aspects of a firm's accounting and auditing practice (see sidebar). The new elements retain many aspects of the previous nine elements but incorporate changes that reflect the dynamics of contemporary practice and the range of accounting and auditing services offered by public accounting firms.

Independence, Integrity, and Objectivity. The former independence element is broadened to include and emphasize the importance of integrity and objectivity in discharging professional responsibilities. While independence (in fact and in appearance) is the foundation for many accounting and auditing services performed by the public accountant, it is not required in all circumstances. Objectivity and integrity, on the other hand, are essential to the performance of all professional services. The revised element incorporates the definitions and descriptions of independence, objectivity, and integrity contained in the AICPA Code of Professional Conduct.

Personnel Management combines the previous four personnel-related elements. The revised element emphasizes the quality of a firm's work ultimately depends on the integrity, objectivity, intelligence, competence, experience, and motivation of the personnel who perform, supervise, and review the work. The element adds the requirement that personnel participate in general and industry-specific continuing professional education to satisfy the continuing professional education requirements of the AICPA and regulatory agencies.

Acceptance and Continuation of Clients and Engagements is expanded to require the firm to consider the nature of the engagement. SQCS No. 1 focused the acceptance/continuation decision on matters related to the integrity of the client's management. Firms are now required to also consider the nature of the requested services and to accept only those accounting and auditing engagements that can be completed with professional competence. In addition, the firm should obtain an understanding with the client as to nature, scope, and limitations of the services to be performed. The standard, however, does not stipulate whether the understanding should be oral or written.

Engagement Performance incorporates the former consultation and supervision elements. Experiences of the AICPA practice-monitoring programs indicated practitioners often confused the quality-control supervision element with the supervision requirements under generally accepted auditing standards. The new engagement-performance element focuses on assuring the work performed meets applicable professional standards, regulatory requirements, and the firm's standard of quality. Engagement performance encompasses all aspects of the engagement's design and execution, including planning, performing, supervising, reviewing, documenting, and communicating results. Engagement performance also covers the firm's policies and procedures to ensure its personnel refer to authoritative literature (or other sources) and consult, on a timely basis, with knowledgeable individuals within or outside the firm as engagement circumstance may require.

Monitoring broadens the prior inspection element, which was probably the least understood quality-control element. Results of the practice-monitoring programs suggest many firms fail to consider or adequately address the inspection element. The new monitoring element encompasses and expands the inspection element identified in SQCS No. 1. Monitoring is a proactive process, whereas inspection is a retroactive evaluation of compliance. Monitoring policies and procedures provide the firm with reasonable assurance that the policies and procedures it establishes for each of the other four elements of quality control are suitably designed and are being effectively applied.

SQCS No. 3

SQCS No. 3 provides guidance on how a CPA firm might implement the new monitoring element into its quality-control system. Monitoring procedures focus on identifying and communicating circumstances that may necessitate changes to or improved compliance with the firm's other quality-control policies and procedures. Monitoring is an ongoing process. However, procedures can be performed at fixed time(s) during the year but covering specified periods, performed as part of ongoing quality-control procedures, or a combination thereof. Critical to the monitoring process is the collection and evaluation of information concerning the--

* relevance and adequacy of the firm's policies and procedures,

* appropriateness of the firm's guidance materials and practice aids,

* effectiveness of professional development activities, and

* compliance with the firm's policies and procedures.

Inspection procedures are the foundation of
the monitoring function because they are a means to evaluate the adequacy of the firm's quality control policies and procedures, its personnel's understanding of those policies and procedures, and the extent of the firm's compliance with its quality-control policies and procedures.

Inspection Programs

The nature and extent of the firm's quality-control system are influenced by numerous factors including its size, the autonomy allowed its personnel, and the nature of its practice. Although the formality and timing of the inspection may vary, all programs should include the following procedures:

* Review of selected administrative and personnel records pertaining to the quality control elements.

* Review of selected engagement working papers, reports, and clients' financial statements.

* Discussions with firm personnel.

* Summarization of the findings from the inspection procedures and consideration of system causes.

* Determination of any corrective
actions to be taken or improvements to be made relative to engagements reviewed or the firm's quality-control policies and procedures.

* Communication of the inspection findings and proposed corrective actions to appropriate firm management personnel.

* Consideration of inspection findings by appropriate firm management personnel for determination and implementation of timely corrective action.

The firm should also consider the timing, nature, and extent of the inspection as well as how it will be documented.

Coverage. The inspection should cover each year between the firm's triennial external peer review and address each of the other four quality-control elements. An external peer review is not a substitute for monitoring procedures. However, the firm may elect to have its external review substitute for some or all of the inspection procedures for the period covered by the review. The inspection should be performed on a timely basis so any corrective actions that may affect subsequent accounting or audit engagements can be implemented.

Timing. Some firms prefer to view themselves as "clients" and schedule the inspection as if it were a peer review and perform the entire inspection at one time. Although the early part of the year is often associated with heavy workloads, some firms may find that early January presents such a scheduling opportunity. Other firms may find performing certain inspection procedures on an ongoing basis to be more efficient and better suited for their practice.

A Professional Engagement. The owner(s) is responsible for the inspection, but may delegate all or part of the testing procedures. However, care should be taken to assure that the individuals possess the appropriate technical training and proficiency for the tasks assigned and are properly supervised. Nonprofessional staff members may be utilized to test compliance with certain administrative policies and procedures. For example, administrative personnel may be used to test personnel records for evidence of compliance with policies and procedures related to the hiring, assignment, advancement, and professional development aspects of the personnel management quality-control element. Although an inspection is an internal function, it should be approached as a professional engagement and performed with objectivity, diligence, and proper supervision.

Scope. The inspection program must be of sufficient scope to allow the firm to evaluate its compliance with policies and procedures as they relate to all control elements. In general, the inspection would include a review of the firm's policies and procedures to determine their appropriateness and an examination of administrative files. It may include interviews with firm personnel to determine their understanding of and compliance with the control system.

Many practitioners mistakenly believe an inspection is only engagement oriented. Admittedly, inspection procedures focusing on the engagement performance element of the quality-control system are of particular interest to the smaller firm with limited supervisory personnel. But an adequate inspection includes an assessment of all applicable administrative and personnel policies and procedures as they relate to both engagement performance and personnel management.

The inspection must include a review of selected accounting and audit engagements including working papers and reports. The reviewed engagements should represent a cross section of the firm's accounting and audit practice as well as its owner(s) and supervisory personnel. Engagement selection should take into consideration industry concentrations, governmental and initial engagements, as well as large, complex, or high risk engagements. If the inspection is patterned after an external peer review, the engagements tested will represent five to 10% of the firm's accounting and audit hours.

The objective of the engagement review is to evaluate compliance with the firm's quality-control policies and procedures as well as the engagement's conformance with professional standards. Each selected engagement should be reviewed to determine the appropriateness of the financial statements and related disclosures, the firm's compliance with professional standards, the appropriateness of the report, the adequacy of the supporting documentation, and the firm's compliance with its control policies and procedures. Although not required, comprehensive checklists similar to those used by external reviewers are useful tools to help ensure all appropriate matters are considered during the engagement review. The depth of the review can vary, but it should include a review of the engagement's most critical or "key areas."

Attitude. For the inspection to be truly productive, the reviewer should possess a questioning, if not skeptical, attitude. Where appropriate, the reviewer should challenge the firm's performance. The reviewer should ask not only whether the firm has met professional standards but also whether the engagements document and demonstrate such performance. In addition, the engagements should be reviewed for opportunities where the firm may be more efficient in meeting its responsibilities.

Findings. The inspection plan should include a summation of findings and a determination of any corrective actions to be taken or improvements to be made. Inspection findings may be isolated situations or symptomatic of underlying deficiencies in the design or operation of the firm's control policies and procedures. Accordingly, care and objectivity are essential to the summation and analysis.

Findings should be evaluated to ascertain any commonalities that may indicate system deficiencies. For example, a pattern of disclosure deficiencies should be scrutinized to determine whether they were due to carelessness in completing a required disclosure checklist (a compliance matter) or a failure to recognize
the need for certain disclosures (a design deficiency).

If the firm determines it complied with professional standards, performed the required procedures, and adhered to its control policies but the working papers do not document the performance, the deficiency is a matter of inadequate documentation. Documentation deficiencies should not be dismissed or minimized. They can make it difficult for the firm to support its conclusions, and, if
pervasive, could be interpreted as a failure to meet accounting and audit
standards.

Corrective Actions, if needed, should be considered in terms of both the specific engagements reviewed and the overall quality-control system. On an engagement level, appropriate corrective actions may simply include adding a note to the files for future reference. However, if the inspection identifies significant deficiencies in the financial statements, omitted procedures, or the appropriateness of the firm's report, the firm should follow applicable professional standards (AU560 or AU561). Corrective actions for systemic deficiencies can include additional staff training, changes in quality-control policies and procedures, acquiring or updating practice aids, or increased monitoring of compliance with existing policies and procedures.

Communication and Follow-Up. Communication of inspection findings and changes in the quality-control system to the firm's professional staff is an important element in any inspection plan. The communication may be oral or in writing and should be appropriately tailored for the staff affected.

For an inspection program to be truly effective, it must be timely performed and incorporate a plan of action to ensure corrective actions are taken and planned changes have been implemented. Within a reasonable period following the inspection, the owner(s) should perform a follow-up review to ensure corrective actions have been implemented and are achieving the desired results.

Alternative Inspection Approaches

Some sole practitioners believe all inspection procedures must be performed at once, or dismiss the inspection process under the belief they cannot adequately review their own work. However, an effective inspection program can be implemented by separating the inspection process from engagement performance. For example, the practitioner may elect to incorporate the engagement review phase of the inspection as an ongoing process of post-issuance reviews carried out prior to starting the current year's engagement. By being removed from the pressures to complete the engagement, the practitioner has the opportunity to review the engagement on a more objective basis. The practitioner's review, however, must be equivalent to an inspection rather than a review performed solely for planning purposes under SAS No. 22, Planning and Supervision.

An alternative ongoing review process would be prerelease reviews. This approach should not be confused with the supervisory review of the working papers, files, and report by the engagement partner before the report is issued. Such procedures never qualify as an inspection for monitoring purposes. On the other hand, the engagement review phase of the inspection may be incorporated as an ongoing procedure by having a management-level prerelease review of the report, financial statements, and working papers by someone not associated with the performance of the engagement, such as a second partner or manager review.

If a firm elects ongoing preissuance or post-issuance review procedures, it must ensure the inspection procedures are sufficiently comprehensive, and findings are periodically summarized, documented, and communicated to the appropriate personnel. The firm's management personnel should evaluate the findings for systemic causes and the determination of corrective actions. Likewise, the results of the inspection and planned changes should be communicated to the affected personnel, and appropriate follow-up actions instituted to ensure the planned changes were implemented.

Because it can be difficult to critically review one's own performance, the sole practitioner or smaller firm with limited supervisory personnel may find it beneficial to engage a qualified individual from outside the firm to perform the inspection procedures related to the engagement performance control element. For example, the firm may periodically request an outside party to inspect a sample of the firm's accounting and auditing engagements for their compliance with professional standards and adherence to the firm's quality control policies and procedures. Such an approach should not be confused with the firm's triennial AICPA Peer Review that addresses all control elements.

Inspection Documentation

Regardless of the size of the firm, all inspection programs should be documented. The nature and extent of the documentation may vary according to the size and nature of the firm's practice. Generally, a formal approach to inspection documentation is preferred for all firms. Such an approach could incorporate various checklists and work programs similar to those used by an external reviewer. However, sole practitioners or firms with very small accounting and audit practices may find an informal approach to documentation more efficient. An informal documentation plan might exclude the use of checklists or work programs, but should include, at a minimum, all notes and summaries of findings and an inspection report.

Impact of New Standards

All firms are required to have a quality-control system. The intent of the new standards is to provide a firm with improved guidance for establishing a system of quality control for its accounting and auditing practice. The new standards are applicable to a firm's system of quality control for its accounting and auditing practice as of January 1, 1997, and thereafter. Firms with well-established quality-control systems, however, will not have to make significant changes in their policies and procedures. *