HKSQM 1 - Quality Management for Firms (Condensed)

Scope & Objective of HKSQM 1

Objective (para 14)

The objective is to design, implement, and operate a system of quality management that provides reasonable assurance that:

• The firm and its personnel fulfill responsibilities in accordance with professional standards and legal/regulatory requirements.
• Engagement reports issued are appropriate in the circumstances.

Scope (paras 17-19)

Applies to all firms performing audits, reviews, assurance, or related services engagements. The firm shall comply with each requirement unless not relevant due to nature and circumstances. The system operates in a continual and iterative manner and addresses eight components.

Key Definitions

Deficiency

Exists when: (i) quality objective not established; (ii) quality risk not identified or properly assessed; (iii) response does not reduce risk to acceptably low level; (iv) other aspect absent or not properly designed/implemented/operating.

Quality Risk

A risk with reasonable possibility of occurring and adversely affecting achievement of one or more quality objectives.

Response

Policies or procedures designed and implemented to address quality risk(s).

Engagement Quality Review

Objective evaluation of significant judgments and conclusions, performed by engagement quality reviewer, completed on or before date of engagement report.

System of Quality Management & Responsibilities

Assignment of Responsibilities (para 20)

Qualification Requirements (para 21)

Individuals must have: appropriate experience, knowledge, influence, and authority; sufficient time; understanding of their assigned roles and accountability.

Direct Line of Communication (para 22)

Individuals assigned operational responsibility must have direct line of communication to those with ultimate responsibility.

Risk Assessment Process

Risk-Based Approach (para 23)

The firm shall design and implement a risk assessment process to:

1. Establish quality objectives – specified by HKSQM 1 and any additional necessary objectives.
2. Identify and assess quality risks – obtain understanding of conditions, events, circumstances, actions or inactions that may adversely affect achievement of quality objectives.
3. Design and implement responses – based on and responsive to reasons for assessments given to quality risks.

Identifying Quality Risks (para 25)

Consider nature and circumstances of the firm (complexity, strategic decisions, resources, law/regulation) and engagements (types of engagements, entities).

Governance, Ethics, Acceptance & Continuance

Governance and Leadership (para 28)

Quality objectives include: demonstrating commitment to quality through culture, leadership accountability, appropriate organizational structure, and resource planning consistent with quality commitment.

Relevant Ethical Requirements (para 29)

The firm and its personnel must understand and fulfill responsibilities in relation to relevant ethical requirements. Others (network, service providers) subject to ethical requirements must also understand and fulfill them.

Acceptance and Continuance (para 30)

Judgments about acceptance/continuance must be appropriate based on information about client integrity and the firm's ability to perform the engagement. Financial and operational priorities shall not lead to inappropriate judgments.

Engagement Performance & Resources

Engagement Performance (para 31)

Quality objectives include:

• Engagement teams understand and fulfill responsibilities.
• Direction, supervision, and review is appropriate.
• Engagement teams exercise appropriate professional judgment and, when applicable, professional skepticism.
• Consultation on difficult or contentious matters is undertaken.
• Differences of opinion are resolved.
• Engagement documentation is assembled on timely basis.

Resources (para 32)

Information, Communication & Specified Responses

Information and Communication (para 33)

Quality objectives include: information system identifies, captures, processes, and maintains relevant/reliable information; culture reinforces responsibility to exchange information; relevant/reliable information exchanged throughout firm and with external parties as required.

Specified Responses (para 34)

• Identify, evaluate, and address threats to compliance with ethical requirements.
• Obtain at least annually documented confirmation of independence compliance from all personnel required to be independent.
• Policies for receiving, investigating, and resolving complaints and allegations.
• Policies for circumstances when information would have caused decline or firm is obligated to accept.
• Communication with those charged with governance for listed entity audits.
• Engagement quality reviews in accordance with HKSQM 2 for listed entity audits and other specified engagements.

Monitoring, Remediation, Evaluation & Documentation

Monitoring and Remediation Process (paras 35-47)

The firm shall establish a monitoring process to provide relevant, reliable, and timely information about the system and take appropriate actions to respond to identified deficiencies.

• Inspection of Completed Engagements: Select at least one completed engagement for each engagement partner on a cyclical basis.
• Root Cause Analysis: Investigate root cause(s) of identified deficiencies.
• Remedial Actions: Design and implement responsive to root cause analysis results.

Evaluating the System (paras 53-55)

The individual(s) assigned ultimate responsibility shall evaluate the system at least annually. Three possible conclusions:

1. System provides reasonable assurance.
2. Except for matters related to identified deficiencies that have severe but not pervasive effect.
3. System does not provide reasonable assurance.

Documentation (paras 57-60)

Documentation shall include: identification of responsible individuals, quality objectives and risks, description of responses, monitoring and remediation evidence, and basis for conclusion. Retention period sufficient to enable monitoring.