ISQM 1 for firms that do no audits
Why ISQM 1 still reaches a practice that only does reviews, compilations or agreed-upon procedures, and how to scale the system to a small firm.
By Achekam · · 5 min read · For Accountants & audit firms in South Africa, Nigeria, Kenya
Plenty of small practices in Johannesburg, Lagos and Nairobi have never signed an audit opinion. Their work is annual financial statements compiled for owner-managed companies, independent reviews for clients who need some assurance but no audit, and the odd set of agreed-upon procedures for a lender or a funder. When the conversation turns to ISQM 1, the partners in these firms often assume it is an auditor's problem.
That assumption is worth testing before a monitoring visit, a peer review or a professional body's inspection tests it for you. The question is not whether you audit. It is which standards your engagements are performed under.
The test is the standard, not the service
The IAASB states plainly that ISQM 1 applies to all firms that perform engagements under its international standards. You can read the scope in the IAASB's own summary of ISQM 1 on quality management for firms, which sets out the firm-level system the standard requires.
Now look at what a non-audit practice actually does. Reviews of historical financial statements are performed under ISRE 2400. Compilations are performed under ISRS 4410 (Revised). Agreed-upon procedures sit under ISRS 4400. All three are IAASB pronouncements. A firm that performs any of them under those standards falls inside the scope that the IAASB describes, even if its client list contains no audit at all.
The local route matters too. In South Africa, Nigeria and Kenya the standards reach firms through the professional bodies and regulators that govern them, so confirm with the body your firm answers to how it applies the IAASB's quality management standards to members who perform no audits. Do not assume an exemption that nobody has written down.
Reviews and other related services
Reviews tend to be the engagements that carry the most quality risk in a non-audit firm, because they end in a conclusion that a reader relies on. Related services carry a different kind of risk: the report states what was done, and a reader can still be misled if the work was careless.
The IAASB's page on ISQM 2, the companion standard on engagement quality reviews, gives its effective date for other assurance and related services engagements as engagements beginning on or after December 15, 2022. That date is well behind us, so a firm doing related services has no transition period left to wait for. Whether any particular engagement needs an engagement quality review is a separate decision your firm makes in its own policies, in response to its own assessed risks.
Quality in compilations
Compilation work is sometimes treated as clerical. The IAASB has never seen it that way. When it released ISRS 4410 (Revised), its March 2012 news release stressed the importance of quality control in compilation engagements. That release is historical, and the language of quality control has since been replaced by quality management, but the point carries over: compiling financial information involves judgement about presentation, about the applicable framework and about whether the information looks misleading.
For a compilation-heavy practice, the quality risks are concrete. A partner signs off a set of statements without reading the accounting policies note. A trainee rolls forward last year's file and misses a change in the client's circumstances. A compilation report goes out on the wrong framework. A system of quality management exists to identify risks like these and put responses in place.
Scaling the system for a small practice
ACCA explains that ISQM 1 requires each firm to build a system of quality management tailored to the firm and its client base, and notes that the standard is designed to scale from small firms to large multinational networks. Scaling down does not mean skipping parts. It means a two-partner firm documents a proportionate response rather than a thick manual.
A workable shape for a practice that does no audits:
- Risk assessment. List the risks that genuinely arise in reviews, compilations and agreed-upon procedures, and write a response for each.
- Leadership. One named partner owns the system and signs the annual evaluation.
- Ethics. Annual independence confirmations, with extra attention on reviews, where independence is required.
- Acceptance. A short checklist before taking on a client or a new type of engagement.
- Engagement performance. A standard file for each engagement type, with a review step before anything is signed.
- Resources. Training records and a plan for who covers when a partner is away.
- Monitoring. A yearly look at a few completed files by someone who did not work on them, with findings recorded and followed up.
Engagement types and quality registers in Achekam
Achekam does not decide whether ISQM 1 applies to your firm, and it does not write your system of quality management. What it gives you are two places where the system can show its working.
First, every engagement is created with a type. Staff choose from types such as annual financial statements compilation, independent review or statutory audit, and the firm can add its own named types. A non-audit practice can use this to separate its reviews from its compilations and from its agreed-upon procedures, so that monitoring can select a sample from each kind of work rather than from one undifferentiated list. The Engagement Templates screen shows Achekam's built-in service templates and how many engagements use each, which is a quick view of the shape of your practice.
Second, the firm's quality registers are kept on the server: professional judgements, quality incidents, complaints and inspection progress, with every version and who changed it. For a small firm, that history is often the evidence that the system operates rather than only exists. One limit is worth knowing: sign-off roles on professional judgements are checked by the screen, not by the server, so the firm's own review should confirm that the right person signed each one.
Where to start
If your practice has never documented a system of quality management, begin with the risk assessment, because every other component hangs from it. Then set up engagement types that mirror the way you actually work, and start logging judgements and incidents as they happen instead of reconstructing them at year end. For the detail of compilation work itself, see compilation engagements under ISRS 4410, and for turning the standard's objectives into your own, read setting ISQM 1 quality objectives.
The firms that find ISQM 1 hardest are the ones that start on the day before an inspection. A small practice that writes down its risks this month will be in a far better position by the time anyone asks.
General guidance only, not advice on your own circumstances. Tax and payroll rules change: check the current position with the authority or your adviser.
