As practice monitoring continues to be an important issue that continues to concern many of our clients these days – which is a good thing – we decided to start a series of articles to help firms tackle the major elements of this process.
Proper practice monitoring ensures that a firm’s system of quality control (or “quality management” under proposed ISQM 1) provides reasonable assurance that:
Internal inspections are the third line of defense to identify or prevent an inappropriate audit opinion that will be (or was already) issued.
Engagement file reviews give us important insight into a firm’s entire system of quality control and are a critical piece of the practice monitoring review function. Aside from annual internal inspections being among the most obvious element of a practice monitoring function, these reviews tend to be the most time intensive; bearing the brunt of many consultations and projects that come across my desk. Therefore, this first article focuses on the design of an effective internal inspection program. In subsequent articles, we will be sharing our thoughts and recommendations regarding implementation, and monitoring effectiveness (the monitoring of the monitoring!). To that end, let's get into designing an effective internal inspection process, what I will refer to as the “Four P’s”:
The Point
The internal inspection program is effective when the results matter. Firms that lay out a specific process, that includes clear definitions on how results are assessed and communicated, find they receive more respect for the process and the obtain better results. Positive results should be praised and negative results should have consequences. Most importantly, everyone should be able to learn from these findings.
Consider these questions as you evaluate the purpose of the program:
As we work with clients to assess the risks and identify the quality objectives in the practice monitoring function, we also help them develop the communication process. It is vital to the success of the process that results are shared in a meaningful way so that everyone (leadership down through staff) can learn from them and enact real and lasting change. A comprehensive risk assessment over this component of quality control should make the point of the program clear.
The People
Ensure you have the right experienced people in place to perform file reviews that address the quality objectives. First, take a look at your client portfolio – the industries in which they operate, the frameworks they report under, the audit standards that are applied. Then, tap the experts in those areas that have the ability to identify not only the “low hanging fruit” but the big issues that pose risk to the firm. Realistically speaking, there may be resource constraints, so does the reviewer delegate certain objective areas of the review, and does the reviewer have a support system in place to discuss the tough judgment calls and the issues that bubble up?
While those individuals need the appropriate technical skills, experience, and training under their belt, reviewers also need appropriate objectivity. An individual assigned to an internal inspection of an engagement needs to be in a position that s/he can challenge the partner and not feel that there would be negative consequences to doing so. Of course, this individual should be independent of the engagement team, the client, and the specific engagement being reviewed. Remember, their independence may not necessarily be inherent in the system of quality control. Be sure to review this prior to finalizing engagement review assignments.
Along with technical skills, competence, and objectivity requirements for a qualified reviewer, training will ensure consistency of the execution of the review and should include clear expectations on the application of the internal inspection audit program. Since two different people – equally qualified – could perform the same review under the same scope and have two different outcomes, all reviewers should be trained under the same guidelines and procedures to ensure the inspection is consistent and reliable.
Finally, strong supervision and a consistent review process is vital to this process.
The Planning
Just like when planning an audit, the design of the overall inspection planning procedures is just as important as the design of the inspection program.
First, the firm-wide inspection plan: An effective internal inspection plan should take stock of the assurance practice and the changes to it since the last internal inspection. Factors should include firm-specific risks and engagement-specific risks. Determine the universe of the higher-risk areas.
Second, consider the objectives you want to achieve. Is it to review compliance with methodology? Or ensure that the planning and identification of controls is appropriate? Or ensure that execution of procedures to respond to significant risks is sufficient? Or all of the above?
We have noted in our work with clients that some internal inspection programs can be more focused on compliance with firm protocol and methodology than the qualitative assessment over compliance with the applicable auditing standards. We believe the real value lies with an adequate balance of the two.
Third, the design of the quality responses should address the quality risks. Quality risks will usually include quality indicators from other data sources such as prior PCAOB inspection deficiencies, other internal and external reviews, restatements, and prior partner/EQR performance.
Consider whether reviews should be pre-issuance or post-issuance. They serve different purposes.
Pre-issuance reviews: A preventative control appropriate for higher-risk engagements that can get ahead of deficiencies before an inappropriate opinion goes out the door. What are the factors driving this type of review? We have developed tools to assist firms design programs to identify many of these risk factors and include, but are not limited to:
In our work with clients, we have seen that the rates of unsupported audit opinions decrease significantly when a pre-issuance review is applied to the engagement and questions from the pre issuance reviewer are cleared to the satisfaction of the reviewer prior to issuance. Getting ahead of the opinion issuance reduces the need to perform procedures under AS 2901 and 2905. While time-intensive, it is usually worth the effort for the highest-risk engagements. Communicating with the engagement teams and coordinating schedules is crucial to keep the client reporting deadlines on track.
Post-issuance reviews: These could be assigned to the rest of the practice. Additionally, firms could decide to use a hybrid approach. Lastly, some firms find it is best to apply some level of unpredictability to the program.
The Procedures
An inspection program will help ensure consistency while taking a look at the balance between a checklist approach and ensuring that your inspectors have the leeway to direct their attention where the risks lie. Particularly for inspections of integrated audits, one of the areas we see where there is a lot of judgment is qualitative information used to in the performance of management review controls. With the right people and planning, the internal inspection procedures should be prescriptive enough to evaluate the work performed beyond a check-the-box exercise.
I hope some of these concepts will spark a renewed interest to evaluate your internal inspection program. With the new QC standards release looming over us, now is a good time for all firms to take the time to review them. Stay tuned as we continue to dig deeper into execution and monitoring of an effective internal inspection program in future articles.
1 Proposed ISQM 1, Quality Management for Firms that Perform Audits or Reviews of Financial Statements, or Other Assurance or Related Services Engagements, paragraph 18.
Jackson Johnson is president of Johnson Global Accountancy, a public accounting and consulting firm with clients throughout the world. He works directly with PCAOB-registered accounting firms and other firms to help them identify, develop, and implement opportunities to improve audit quality. Jackson also works with public and private companies on various technical accounting and transactional matters. His experience includes nearly six years with the PCAOB, where he worked with small and medium-sized accounting firms throughout the world, including foreign affiliates of large international accounting firms, in the areas of firm quality control and ICFR audits of financial statements. Prior to the PCAOB, Johnson worked with public and private clients in a variety of industries at Grant Thornton LLP in Boston, Los Angeles, and Hong Kong.
Johnson Global Advisory
1717 K Street NW, Suite 902
Washington, D.C. 20006
USA
+1 (702) 848-7084