Monitoring and remediation are central to the success of the system of quality management (SoQM) that each audit firm has been operating since the International Standard on Quality Management (ISQM) 1 came into effect on 15 December 2022. 

As our November 2024 virtual event ‘ISQM 1 – maintaining momentum and feeling safe’ (available on demand) makes clear, monitoring and remediation processes, including root cause analysis (RCA), are mandatory and not just ‘nice to have’.

ISQM 1 (para 35) requires each firm to establish a monitoring and remediation process to:

• provide relevant, reliable and timely information about the design, implementation and operation of the firm’s SoQM; and
• allow the firm to respond to identified deficiencies and take remedial action on a timely basis. 

Like many aspects of quality management under ISQM 1, establishing a monitoring and remediation process is part of an ongoing journey. 

As Neil Lawrinson, a reviewer in ICAEW’s Quality Assurance Department (QAD) emphasises during his presentation for our ISQM 1 event: “The monitoring and remediation process is a continuous circle.”

The wheel does not stop spinning. “It’s important that findings from monitoring activities are evaluated to identify deficiencies, leading into root cause analysis, then design and implementation of remedial actions, with post-implementation review of those remedial actions. Then around you go again, maintaining momentum,” he says.

To comply with ISQM 1 monitoring and remediation requirements, each audit firm must: 

• design and perform monitoring activities in order to identify deficiencies, taking into account, for example, results of previous monitoring activities (ISQM 1 para 36/37);
• include cold file reviews/reviews of completed engagements (para 38);
• evaluate findings to determine whether deficiencies exist (para 40); 
• evaluate the severity and pervasiveness of identified deficiencies, including use of RCA (para 41); and 
• implement remedial actions responsive to that RCA (para 42).

Because monitoring activities undertaken by firms to comply with ISQM 1 must be tailored to the SoQM operated by the firm, there may be wide variations across organisations. But even the smallest firm, with a handful of audits, will need its SoQM monitoring (and remediation) activities to consider key quality objectives and risks relating to:

• the firm’s risk assessment process;
• governance and leadership;
• relevant ethical requirements;
• acceptance and continuance of client relationships and specific engagements;
• engagement performance;
• resources; and
• information and communication. 

During his presentation, Lawrinson considers what monitoring and remediation procedures might look like, using an aspect of whole firm requirements, the acceptance and continuance mandatory quality objective from ISQM 1. This example and the list above serve as a reminder that SoQM monitoring activities need to be ongoing and broader than merely reviewing completed audit or review engagements.

ISQM 1 implementation was never meant to be a one-off exercise. Managing quality must be proactive and iterative and so must each firm’s monitoring and remediation processes. This can present challenges for firms, but it also presents valuable learning opportunities that can be vital on the road to continuous improvements in quality management in audit firms. 

There is always room for improvement – and Lawrinson’s presentation offers plenty of insights and reminders on various aspects of ISQM 1 monitoring and remediation. It considers, for example, the role of cold file reviews in monitoring and remediation, learnings on root cause analysis and ISQM 1-related good practices seen by QAD reviewers during their visits to firms.