Which engagements should have a quality review?
How a firm decides which engagements get an engagement quality review under its own ISQM 1 policy, since Achekam requires none for South African firms.
By Achekam · · 4 min read · For Accountants & audit firms in South Africa, Nigeria, Kenya
"Do we need an EQR on this one?" is a question too many firms answer in the week the report is due, usually with "probably not, there's no time". The answer then depends on the deadline rather than the risk, and an inspector reading the file will notice.
The decision belongs much earlier, in a written policy that names the engagements that must have an engagement quality review and the criteria for adding others. Achekam will enforce a review once a reviewer is named, but for a South African firm it does not decide that any engagement needs one. That choice is the firm's. This article sets out what the standards require, what they leave to you, and how to turn the rest into a policy that works.
What ISQM 1 requires and what it leaves to the firm
ISQM 1 requires a firm to set policies under which an engagement quality review is performed for:
- audits of financial statements of listed entities;
- audits or other engagements where law or regulation requires one;
- audits or other engagements where the firm decides a review is an appropriate response to one or more quality risks.
The first two are fixed. The third is the firm's own judgement, and in most small and medium practices it is where nearly all the reviews come from. ISQM 2 then covers who may be the reviewer and how the review is performed and documented. The IAASB's page on ISQM 2 describes the standard's coverage of the reviewer's appointment and eligibility and of how the review is carried out and recorded.
The standards reach each country through its own route. In South Africa, IRBA regulates auditors and its auditing standards follow the IAASB's. Nigeria applies the ISAs as issued, with ISQM 1 and ISQM 2 from 15 December 2022. Kenya applies the ISAs as issued, with ISQM 1 and ISQM 2. The IAASB's definitions around listed and public interest entities have been revised in recent years, so check which version of the standards your country has adopted for the periods you audit.
Listed and public interest audits
Audits of listed entities are the clear case. Beyond them, many firms extend the requirement to other entities with significant public interest, even where the standard does not demand it. Candidates include banks and insurers, pension funds, large non-profit organisations handling public money, and state-owned entities. The reasoning is simple: the more people rely on the statements, the higher the cost of getting them wrong.
Risk-based criteria for everything else
For the remaining engagements, write criteria that track the firm's actual quality risks. Useful ones include:
| Criterion | Why it suggests a review |
|---|---|
| A modified opinion or a going concern matter | Significant judgements with direct effect on the report |
| A first-year audit of a complex client | Opening balances and unfamiliar risks |
| An industry new to the engagement team | Specialist accounting and audit areas |
| Significant fee dependence on one client | A threat to objectivity at engagement level |
| Recent findings on the partner's files | Monitoring results that point to a risk |
| A client's size or public profile | Wider reliance on the statements |
South African firms already record one measure of public significance. For a South African client, staff prepare a public interest score for a financial year from the client's records, a different person reviews it, and Achekam then says whether an audit or an independent review is required. A firm can use the same score as one input to its review criteria. The approved thresholds Achekam's decisions use, such as those for the public interest score, can be read by partners and administrators in the Regulatory Rule Book with their change log; only Achekam's platform administrators change them, never one person alone.
Writing the policy down
A policy that lives in partners' heads is applied inconsistently. Put it in the quality manual, in one page:
- The engagements that always require a review.
- The criteria that trigger a review for other engagements.
- Who decides, and when: at acceptance or planning, never at completion.
- What happens when an engagement meets a criterion but the partner believes a review is unnecessary: who may waive it, and how the reason is recorded.
- Eligibility rules for reviewers, including cooling-off for former engagement partners.
Record the decision for each engagement, whether yes or no. Achekam keeps the firm's quality registers, with every version and who changed it, and a firm can use them to log policy decisions and exceptions alongside other quality records.
Naming the reviewer early
Once the policy says yes, name the reviewer at planning. In Achekam a partner names the engagement quality reviewer, who must be a partner or senior manager not on the engagement team. That person must then clear the audit report before it can be issued, and the clearance cannot be bypassed.
A reviewer named in planning can read the risk assessment and the significant judgements as they form, which is what ISQM 2 intends. One named a week before signing can only read conclusions. Naming an engagement quality reviewer covers the steps, and where a full review is more than an engagement needs, a pre-issuance review by another partner may fit better.
This month
List every engagement due in the next year, mark those that meet your criteria, and decide for each one whether a review is required. Then name the reviewers for the first quarter's engagements, and add the policy to the firm's ISQM 1 system.
General guidance only, not advice on your own circumstances. Tax and payroll rules change: check the current position with the authority or your adviser.
