LeftMenu

Search Under HKSQM 1 Quality Management for Firms that Perform Audits or Reviews of Financial Statements, or Other Assurance or Related Services Engagements and HKSQM 2 Engagement Quality Reviews

HKSQM 1 Quality Management for Firms that Perform Audits or Reviews of Financial Statements, or Other Assurance or Related Services Engagements and HKSQM 2 Engagement Quality Reviews

The Questions and Answers (Q&As) below are prepared and updated by staff at the Institute's Standard Setting Department and do not necessarily reflect the views of the Standard Setting Department, the Institute, the Council or any of its committees. The Institute takes official positions only after extensive review, in accordance with the Institute's due process.

The Standard Setting Department welcomes your comments and feedback, which should be sent to commentletters@hkicpa.org.hk.

The Q&As are intended for general guidance only. The Institute DOES NOT accept any responsibility or liability, and DISCLAIMS all responsibility and liability, in respect of the Q&As and any consequences that may arise from any person acting or refraining from action as a result of any materials in the Q&As.

HKSQM 1 and HKSQM 2

Q1.

Please advise whether a subsidiary (itself is not listed) of a listed entity is within the meaning of HKSQM 1 paragraph 34(f)(i). What if the subsidiary is dormant or trivial/ immaterial within the listed entity (e.g., profit/loss or assets/ liabilities less than 5% of the listed entity)? What if it is a significant component of the listed entity?

HKSQM 1 paragraph 34(f)(i) states that engagement quality reviews are required for audits of financial statement of listed entities.
For entities other than listed entities (e.g. a subsidiary of a listed group), the firm should refer to the following requirements of HKSQM 1 to determine if an engagement quality review is needed:
- Audits or other engagements for which an engagement quality review is required by law or regulation, for examples, audit engagements for entities that: (Ref: Paragraphs 34(f)(ii), A133)
  - Are public interest entities as defined in a particular jurisdiction¹;
  - Operate in the public sector or which are recipients of government funding, or entities with public accountability;
  - Operate in certain industries (e.g., financial institutions such as banks, insurance companies and pension funds);
  - Meet a specified asset threshold; or
  - Are under the management of a court or judicial process (e.g., liquidation).
    
    (¹In the Financial Reporting Council Ordinance (Cap. 588) (FRC Ordinance), a “public interest entity” means (a) a listed corporation (equity); or (b) a listed collective investment scheme. There is no provision in the FRC Ordinance requiring an engagement quality review to be performed for audit engagements of particular types of entities. Practitioners are to comply with the requirements in HKSQM 1 for the purposes determining audit engagements requiring an engagement quality review, and section 325, Chapter A of the Code in relation to the objectivity of an engagement quality reviewer.)
- Audits or other engagements for which the firm determines that an engagement quality review is an appropriate response to address one or more quality risk(s). The firm’s understanding of the conditions, events, circumstances, actions or inactions that may adversely affect the achievement of the quality objectives, as required by paragraph 25(a)(ii), relates to the nature and circumstances of the engagements performed by the firm. In designing and implementing responses to address one or more quality risk(s), the firm may determine that an engagement quality review is an appropriate response based on the reasons for the assessments given to the quality risks. Examples of conditions, events, circumstances, actions or inactions giving rise to one or more quality risk(s) for which an engagement quality review may be an appropriate response include: (Ref: Paragraphs 34(f)(iii), A134)
  - Engagements that involve a high level of complexity or judgment, such as (i) audits of financial statements for entities for which uncertainties exist related to events or conditions that may cast significant doubt on their ability to continue as a going concern; audits of financial statements for entities operating in an industry that typically has accounting estimates with a high degree of estimation uncertainty (e.g., certain large financial institutions or mining entities); or assurance engagements that require specialized skills and knowledge in measuring or evaluating the underlying subject matter against the applicable criteria (e.g., a greenhouse gas statement in which there are significant uncertainties associated with the quantities reported therein).
  - Entities in emerging industries, or for which the firm has no previous experience.
  - …… (Refer to paragraph A134 for more examples.)
- In some cases, the firm may determine that there are no audits or other engagements for which an engagement quality review is needed. (Ref: Paragraph A136) However, the requirement in HKSQM 1 to establish policies or procedures addressing engagement quality reviews would still apply to the firm. The nature and circumstances of engagements the firm performs may be such that they do not require an engagement quality review in accordance with the firm’s policies or procedures. (Ref: ISQM 1: First Time Implementation Guide, p.62)
- The nature and circumstances of public sector entities (e.g., due to their size and complexity, the range of their stakeholders, or the nature of the services they provide) may give rise to quality risks. In these circumstances, the firm may determine that an engagement quality review is an appropriate response to address such quality risks. Law or regulation may establish additional reporting requirements for the auditors of public sector entities (e.g., a separate report on instances of non-compliance with law or regulation to the legislature or other governing body or communicating such instances in the auditor’s report on the financial statements). In such cases, the firm may also consider the complexity of such reporting, and its importance to users, in determining whether an engagement quality review is an appropriate response. (Ref: Paragraph A137)
- HKSQM 2 paragraph A33 further states that in some cases, an engagement quality reviewer may be appointed for an audit of an entity or business unit that is part of a group, for example, when such an audit is required by law, regulation or other reasons. In these circumstances, communication between the engagement quality reviewer for the group audit and the engagement quality reviewer for the audit of that entity or business unit may help the group engagement quality reviewer in fulfilling the responsibilities in accordance with paragraph 21(a). For example, this may be the case when the entity or business unit has been identified as a component for purposes of the group audit and significant judgments related to the group audit have been made at the component level.

Q2.	What are the key differences in the context of engagement quality reviews from the extant HKSQC 1 and HKSA 220?

The requirements for engagement quality reviews currently reside in extant HKSQC 1 and HKSA 220. When the new standard becomes effective, HKSQM 2 replaces the extant provisions relating to engagement quality reviews in HKSQC 1 and HKSA 220.

HKSQM 1 addresses the scope of engagements subject to an engagement quality review and HKSQM 2 addresses the specific requirements for the appointment and eligibility of the engagement quality reviewer and the performance and documentation of the review. Although there are no longer requirements for the performance of engagement quality reviews in ISA 220 (Revised), the revised standard still contains requirements regarding the engagement partner’s responsibilities relating to the engagement quality review, which largely focus on how the engagement partner and the engagement team interact with the engagement quality reviewer.

The diagram below illustrates how HKSQM 1/ ISQM 1 relates to HKSQM 2/ ISQM 2 in terms of engagement quality reviews. (Ref: ISQM 2: First Time Implementation Guide, p.6)

Members are encouraged to make reference to the IAASB’s ISQM 2: First Time Implementation Guide that summarizes the new key requirements in relation to engagement quality reviews under the new and revised Quality Management Standards.

Q3.	Will HKICPA issue some reference materials to demonstrate some specified samples of quality risk and responses, so that SMP can take reference from it and tailor to their own set?

The Institute continues to identify sources of support tools and learning materials that are relevant to the new and revised Quality Management Standards. Members may refer to our resources centre “Quality Management for Firms and Engagements” for the related pronouncements, guides, articles and webcasts, etc. Any new reference materials will be posted at the resource centre.

Q4.	Is there any definition of larger firms and smaller firms when we apply the scalability example?

HKSQM 1 does not provide a definition of larger and smaller firms. HKSQM 1 mentions that the nature, timing and extent of the responses is driven by the quality risks, which are affected by the nature and circumstances of the firm and its engagements. Smaller and less complex firms are likely to have different quality risks than larger and more complex firms, thereby requiring a different response. For quality risks that are common across all firms of varying size and complexity, the nature, timing and extent of the responses may differ given the circumstances of the firm. (Ref: ISQM 1: First Time Implementation Guide, p.30)

HKSQM 1 states that:

Paragraph 7: The firm is required to apply a risk-based approach in designing, implementing and operating the components of the system of quality management in an interconnected and coordinated manner such that the firm proactively manages the quality of engagements performed by the firm. (Ref: Paragraph A4)
Paragraph 10: In applying a risk-based approach, the firm is required to take into account (a) the nature and circumstances of the firm; and (b) the nature and circumstances of the engagements performed by the firm. Accordingly, the design of the firm’s system of quality management, in particular the complexity and formality of the system, will vary. For example, a firm that performs different types of engagements for a wide variety of entities, including audits of financial statements of listed entities, will likely need to have a more complex and formalized system of quality management and supporting documentation, than a firm that performs only reviews of financial statements or compilation engagements.

Q5.	Any requirement for the firm to communicate with client of its system of quality management?

HKSQM 1 requires that:

Paragraph 33(d)(ii): Information is communicated externally when required by law, regulation or professional standards, or to support external parties’ understanding of the system of quality management. Examples of when law, regulation or professional standards may require the firm to communicate information to external parties: (Ref: Paragraph A114)
- The firm becomes aware of non-compliance with laws and regulations by a client, and relevant ethical requirements require the firm to report the non-compliance with laws and regulations to an appropriate authority outside the client entity, or to consider whether such reporting is an appropriate action in the circumstances.
- Law or regulation requires the firm to publish a transparency report and specifies the nature of the information that is required to be included in the transparency report.
- Securities law or regulation requires the firm to communicate certain matters to those charged with governance.
Paragraph 34(e)(i): Communication with those charged with governance when performing an audit of financial statements of listed entities about how the system of quality management supports the consistent performance of quality audit engagements.
Paragraph A128: HKSA 260 (Revised) states that in some circumstances, it may be appropriate to communicate with those charged with governance of entities other than listed entities (or when performing other engagements), for example, entities that may have public interest or public accountability characteristics, such as entities that hold a significant amount of assets in a fiduciary capacity for a large number of stakeholders including financial institutions, such as certain banks, insurance companies, and pension funds; entities with a high public profile, or whose management or owners have a high public profile; entities with a large number and wide range of stakeholders.

Q6.	Would it be better to have a single source of communication in order to avoid inconsistency of the message delivered?

According to HKSQM 1, the public interest is served by the consistent performance of quality engagements. The design, implementation and operation of the system of quality management enables the consistent performance of quality engagements by providing the firm with reasonable assurance that the objectives of the system of quality management are achieved. The firm is required to establish responses to ensure the information are communicated consistently across the firm and to external parties in order to support consistent implementation and operation of the responses to achieve consistent performance of quality engagements. (Ref: Paragraphs A126, A205)

There are a variety of methods a firm may use to communicate information, for example, direct oral communication, manuals of policies or procedures, newsletters, alerts, emails, intranet or other web-based applications, training, presentations, social media, or webcasts. In determining the most appropriate method(s) and frequency of communication, the firm may take into consideration a variety of factors, including:

The audience to whom the communication is targeted; and
The nature and urgency of the information being communicated. In some circumstances, the firm may determine it necessary to communicate the same information through multiple methods in order to achieve the objective of the communication.

In such cases, the consistency of the information communicated is important. (Ref: ISQM 1: First Time Implementation Guide, p.57)

Practically, a firm may have a single source of information (e.g. an internal webpage) and have multiple methods to deliver the same source of information (e.g. oral or email reminders referring to the internal webpage) to ensure consistency.

Q7.	Service providers include all kinds of service providers or only professional service providers which are related to the engagements?

HKSQM 1 paragraph 16(v) defines “service provider” in the context of this HKSQM as an individual or organization external to the firm that provides a resource that is used in the system of quality management or in the performance of engagements*. Service providers exclude the firm’s network, other network firms or other structures or organizations in the network. (Ref: Paragraphs A28, A105)
*Engagements include audits or review of financial statements, or other assurance or related services engagements.

HKSQM 1 paragraph 32(h) further explains that human, technological or intellectual resources from service providers that are appropriate for use in the firm’s system of quality management and in the performance of engagements, shall take into account the quality objectives in paragraph 32 (d), (e), (f) and (g). (Ref: Paragraphs A105–A108)

Q8.	Operational responsibility for the SOQM and Operational responsibility for specific aspects of the SOQM can be the same person?

HKSQM 1 paragraph 21 states that in assigning the roles in paragraph 20, the firm shall determine that the individual(s):

(a) has the appropriate experience, knowledge, influence and authority within the firm, and sufficient time, to fulfill their assigned responsibility; and (b) understands their assigned roles and that they are accountable for fulfilling them.

HKSQM 1 paragraph A35 gives a scalability example to demonstrate how assigning roles and responsibilities in a less complex firm may be undertaken. In a less complex firm, ultimate responsibility and accountability for the system of quality management may be assigned to a single managing partner with sole responsibility for the oversight of the firm. This individual may also assume responsibility for all aspects of the system of quality management, including operational responsibility for the system of quality management, compliance with independence requirements and the monitoring and remediation process.

Q9.	What are the key differences between HKSQC 1 and HKSQM 1?

HKSQM 1 aims to enhance the robustness of the firm’s system of quality management. It requires the firm to customize the design, implementation and operation of its system of quality management based on the nature and circumstances of the firm and the engagements it performs. It also requires the firm to transition from policies and procedures that address standalone elements, as required by extant HKSQC 1, to an integrated quality management approach that reflects upon the system as a whole.

Key changes include:

A more proactive and tailored approach to managing quality, focused on achieving quality objectives through identifying risks to those objectives, and responding to the risks.
Enhanced requirements to address firm governance and leadership, including increased leadership responsibilities.
Expanded requirements to modernize the standard and reflect factors affecting the firm’s environment, including requirements to address technology, networks, and the use of external service providers.
New requirements addressing information and communication, including communication with external parties.
Enhanced requirements for monitoring and remediation to promote more proactive monitoring of the system of quality management as a whole, and effective and timely remediation of deficiencies

(Ref: ISQM 1: First Time Implementation Guide, p.3-4)

Q10.	In the standard, it does not mention the quality objectives for risk assessment process and monitoring and remediation process, should the quality objectives in relation to these two components be established?

HKSQM 1 sets out quality objectives for six components, namely governance and leadership, relevant ethical requirements, acceptance and continuance, engagement performance, resources and information and communication. A firm is required to establish quality objectives for these components.

There are no quality objectives for the firm’s risk assessment process and the monitoring and remediation process because these components are processes. Rather, HKSQM 1 sets out specific requirements of how these processes should be applied. (Ref: ISQM 1: First Time Implementation Guide, p.19)

Although HKSQM 1 does not require quality objectives to be established for these two processes, a firm can still consider whether additional quality objectives are established.

Total: Bookmarks

Bookmark(s) Click icon to add bookmark(s) to my profile

User Profile Bookmark(s)

Total: Bookmarks

Click icon to add bookmark(s) to my profile

Bookmark(s)

User Profile Bookmark(s)

HKSQM 1 Quality Management for Firms that Perform Audits or Reviews of Financial Statements, or Other Assurance or Related Services Engagements and HKSQM 2 Engagement Quality Reviews