CPA Exam AUD: Quality Control Standards for CPA Firms

Quality Control Standards: CPA Exam AUD Essentials

Quality control standards govern the policies and procedures that CPA firms establish to ensure the quality of their audit and other professional services. QC Section 10 (A Firm's System of Quality Control) establishes the requirements for a firm's system of quality control. Understanding these standards is important for the AUD exam because they provide the framework within which individual audit engagements are conducted.

The Six Elements of Quality Control

A firm's system of quality control must include policies and procedures addressing six elements:

1. Leadership responsibilities for quality within the firm (tone at the top): The firm's leadership must establish a culture that recognizes quality as essential to performing engagements. The firm's internal culture must emphasize that quality is paramount. This includes actions, messages, and policies that demonstrate the firm's commitment to quality and ethical behavior.
2. Relevant ethical requirements: The firm must establish policies and procedures to ensure compliance with relevant ethical requirements, including independence. The firm should have procedures for identifying threats to independence, evaluating their significance, and applying safeguards. Annual independence confirmations from personnel are a common requirement.
3. Acceptance and continuance of client relationships and engagements: The firm should establish policies for accepting new clients and continuing existing relationships. Considerations include the integrity of the client's management, whether the firm has the competence and resources to perform the engagement, and whether the firm can comply with ethical requirements. A firm should withdraw from an engagement if it discovers information that would have caused it to decline the engagement initially.
4. Human resources: The firm must have policies to ensure it has sufficient personnel with the competence, capabilities, and commitment to ethical principles to perform engagements in accordance with professional standards. This includes recruitment, professional development, performance evaluation, compensation, promotion, and assignment of engagement teams.
5. Engagement performance: The firm must have policies to ensure engagements are performed in accordance with professional standards and regulatory requirements, and that the firm or engagement partner issues appropriate reports. This includes policies on supervision, review of engagement work, consultation on difficult matters, and resolution of differences of opinion. The engagement quality control review (discussed below) is part of this element.
6. Monitoring: The firm must have a process to monitor the quality control system and evaluate whether the policies and procedures are relevant, adequate, and operating effectively. This includes ongoing consideration and periodic evaluation of the quality control system, including inspection of a selection of completed engagements. Deficiencies identified through monitoring must be communicated and corrective action taken.

Engagement Quality Control Review (EQCR)

An engagement quality control review (sometimes called a concurring review or second partner review) is an objective evaluation of the significant judgments made by the engagement team and the conclusions reached in formulating the report. The review is performed by a qualified individual who is not a member of the engagement team. Firms should establish criteria for determining which engagements require an EQCR, which typically includes audits of public companies (required by PCAOB standards), audits of financial statements where the law or regulation requires an EQCR, and other engagements the firm deems appropriate based on risk.

The reviewer evaluates the engagement team's assessment of independence, significant risks identified and the responses to those risks, judgments about materiality, the appropriateness of the audit opinion, and whether appropriate consultation occurred. The report should not be dated until the EQCR is complete.

Peer Review

AICPA members in public practice who perform audits, reviews, compilations, or other attest services are required to have their firm enrolled in a peer review program. A peer review is an external review of a firm's quality control system. There are two types of peer review: a system review (required for firms that perform audits or examinations) evaluates the firm's system of quality control, and an engagement review (for firms that only perform compilations, reviews, or preparation engagements) focuses on selected engagements. Peer reviews result in a rating of pass, pass with deficiency(ies), or fail.

PCAOB Quality Control Requirements

For firms registered with the PCAOB, additional quality control requirements apply. The PCAOB adopted Quality Control Standard QC 1000 (A Firm's System of Quality Control) which aligns with international quality management standards. PCAOB-registered firms are subject to PCAOB inspections, which assess the quality of audit work and the firm's quality control system. Deficiencies identified in inspections can lead to sanctions, remedial actions, or public reporting of deficiencies.

Documentation of Quality Control

The firm should document its quality control policies and procedures, including evidence that the system is operating effectively. Documentation includes independence confirmations, records of acceptance and continuance evaluations, evidence of engagement quality reviews, records of consultations, monitoring procedures performed, and corrective actions taken. Adequate documentation helps demonstrate compliance with quality control standards during peer reviews and PCAOB inspections.

Exam Tips for Quality Control Standards

• Memorize the six elements: leadership, ethics, acceptance/continuance, human resources, engagement performance, and monitoring.
• The EQCR must be completed before the audit report is dated.
• Peer review is required for AICPA member firms performing attest services.
• Peer review outcomes are pass, pass with deficiency(ies), or fail.
• Monitoring includes both ongoing activities and periodic inspections of completed engagements.