STANDARD ON QUALITY CONTROL (SQC) 1

QUALITY CONTROL FOR FIRMS THAT PERFORM AUDITS AND REVIEWS OF HISTORICAL FINANCIAL INFORMATION, AND OTHER ASSURANCE AND RELATED SERVICES ENGAGEMENTS (Effective for all engagements relating to accounting periods beginning on or after April 1, 2009)

This SQC is to be read in conjunction with the requirements of the Chartered Accountants Act, 1949, the Code of Ethics and other relevant pronouncements of the Institute (hereinafter referred to as “the Code”

Introduction

The firm should establish a system of quality control designed to provide it with reasonable assurance that the firm and its personnel comply with professional standards, regulatory and legal requirements, and that reports issued by the firm or engagement partner(s) are appropriate in the circumstances.

Elements of a System of Quality Control

The firm’s system of quality control should include policies and procedures addressing each of the following elements:

1. Leadership responsibilities for quality within the firm
2. Ethical requirements
3. Acceptance and continuance of client relationships and specific engagements
4. Human resources
5. Engagement performance
6. Monitoring

Policies and procedures should be documented and communicated to the firm’s personnel.

Leadership Responsibilities for Quality within the firm

Policies and procedures should be designed to promote an internal culture recognising the fact that quality is essential in performing engagements.; the firm’s highest authority should assume ultimate responsibility for the system of quality control.

Any person or persons who are assigned with operational responsibility for the firm’s quality control system should have sufficient and appropriate experience, ability, and the necessary authority.

Ethical Requirements

Policies and procedures should be designed to provide with reasonable assurance that all concerned comply with relevant ethical requirements.

Policies and procedures should emphasise the fundamental principles, e.g

• The leadership of the firm, education and training, monitoring, and a process for dealing with non-compliance

Independence

Policies and procedures should be designed to provide reasonable assurance that all concerned, maintain independence where required by the Code. It should enable the firm to:

1. Communicate its independence requirements to all concerned; and
2. Identify and evaluate circumstances and relationships that create threats to independence, and to take appropriate action to eliminate or reduce those threats to an acceptable level by applying safeguards, or, if considered appropriate, to withdraw from the engagement.

Such policies and procedures should require:

1. Personnel to provide the firm with relevant information about client engagements including the scope of services, to enable the firm to evaluate the overall impact on independence requirements;
2. Personnel to promptly notify circumstances and relationships that create a threat to independence so as to enable the firm to take appropriate action; and
3. Accumulate and communicate relevant information to appropriate personnel so that:
   • All can readily determine whether they satisfy independence requirements;
   • Records relating to independence can be maintained and updated; and
   • Appropriate action regarding identified threats to independence can be taken.

Policies and procedures should be designed to provide reasonable assurance that it is notified about breaches of independence requirements, and to enable it to take appropriate actions to resolve such situations, which include:

• All concerned to promptly notify the firm on becoming aware about the independence breaches;
• The firm to promptly communicate identified breaches of these policies and procedures to:
  • The one who needs to address the breach; and
  • Those who need to take appropriate action; and
• Promptly communicate by those concerned to the firm of the actions taken to resolve the matter, so that the firm can determine whether it should take further action.
• At least annually, the firm should obtain written confirmation of compliance with its policies and procedures on independence from all firm personnel;

Establish policies and procedures to:

• Set out criteria for determining the need for safeguards to reduce the familiarity threat to an acceptable level over a long period of time; and
• For all audits of financial statements of listed entities, requiring the rotation of the engagement partner after a specified period in compliance with the Code. Partner should be rotated after a pre-defined period, normally not more than seven years.

Acceptance and Continuance of Client Relationships and Specific Engagements

Establish policies and procedures for the acceptance and continuance of client relationships and specific engagements, designed to provide it with reasonable assurance to undertake or continue relationships and engagements only where it:

• Has considered the integrity of the client
• Is competent, capable and has time and resources to do so; and
• Can comply with the ethical requirements

If issues have been identified and the firm decides to accept or continue with the engagement, it should document how the issues were resolved.

Policies and procedures on the continuance of the engagement and the client relationship should include consideration of:

1. The professional and legal responsibilities that apply to the declining engagement circumstances, including whether there is a requirement to report to the person who made the appointment or, to regulatory authorities; and
2. The possibility of withdrawing from the engagement or from both, the engagement and the client relationship.

Human Resources

Policies and procedures should be designed to provide the firm with reasonable assurance that it has sufficient personnel with the capabilities, competence, and commitment to ethical principles necessary to perform its engagements in accordance with professional standards and regulatory and legal requirements, and to enable all concerned to issue reports that are appropriate in the circumstances.

Assignment of Engagement Teams

The firm should assign responsibility for each engagement to an engagement partner. The firm should establish policies and procedures requiring that:

• The identity and role of the engagement partner are communicated to key members of the client’s management and those charged with governance;
• The engagement partner has the appropriate capabilities, competence, authority and time to perform the role; and
• The responsibilities of the engagement partner are clearly defined and communicated to that partner.

The firm should assign appropriate staff with capabilities, competence and time to perform engagements in accordance with professional standards and regulatory and legal requirements, and to enable those concerned to issue reports that are appropriate in the circumstances.

Engagement Performance

Policies and procedures should be designed to provide with reasonable assurance that engagements are performed in accordance with professional standards and regulatory and legal requirements, and that all concerned issues reports that are appropriate in the circumstances.

Consultation

Policies and procedures should be designed to provide reasonable assurance that:

• Appropriate consultation takes place on difficult or contentious matters;
• Sufficient resources are available to enable appropriate consultation;
• The nature and scope of consultations are documented;
  and
• Conclusions from consultations are documented and implemented.

Differences of Opinion

Establish policies and procedures for dealing with and resolving differences of opinion within the engagement team, with those consulted and, where applicable, between the engagement partner and the engagement quality control reviewer. Conclusions should be documented and implemented. The report should not be issued until the matter is resolved.

Engagement Quality Control Review

Establish policies and procedures an engagement quality control review that provides an objective evaluation of the significant judgments made by the engagement team and the conclusions reached in formulating the report. Such policies and procedures should:

• Require an engagement quality control review for all audits of financial statements of listed entities;
• Set out criteria against which all other audits and reviews of historical financial information, and other assurance and related services engagements should be evaluated to determine whether an engagement quality control review should be performed; and
• Require an engagement quality control review for all engagements meeting the criteria established in compliance with the above para.

These policies and procedures should require the completion of the engagement quality control review before the report is issued.

Establish policies and procedures setting out

• The nature, timing and extent of an engagement quality control review;
• Criteria for the eligibility of engagement quality control reviewers; and
• Documentation requirements for an engagement quality control review.

Criteria for the Eligibility of Engagement Quality Control Reviewers

Policies and procedures should address the appointment of engagement quality control reviewers and establish their eligibility through:

• The technical qualifications, experience and authority to perform the role; and
• The degree to which a quality control reviewer can be consulted on the engagement without compromising the reviewer’s objectivity.

Documentation of the Engagement Quality Control Review

Policies and procedures on documentation of the engagement quality control review should require that:

• The procedures on quality control review have been performed;
• The quality control review is completed before the report is issued; and
• The reviewer is not aware of any unresolved matters which lead to inappropriate conclusions.

Engagement Documentation

Establish policies and procedures:

• For engagement teams to complete the assembly of final engagement files on a timely basis after the engagement reports have been finalized;
• Designed to maintain the confidentiality, safe custody, integrity, accessibility and retrievability of engagement documentation.
• For the retention of engagement documentation for a period sufficient to meet the needs of the firm or as required by law or regulation, which should be not be shorter than 7 years from the date of report.

Monitoring

Policies and procedures should be designed to provide reasonable assurance that these policies and procedures relating to the system of quality control are relevant, adequate, operating effectively and complied with in practice. Such policies and procedures should include an ongoing consideration and evaluation of the firm’s system of quality control, including a periodic inspection of a selection of completed engagements.

Evaluate the effect of deficiencies noted as a result of the monitoring process and should determine whether they are either:

• Instances that do not necessarily indicate that the system of quality control is insufficient to provide it with reasonable assurance that it complies with professional standards and regulatory and legal requirements, and that the reports issued are appropriate in the circumstances; or
• Systemic, repetitive or other significant deficiencies that require prompt corrective action.

The firm should communicate to relevant engagement partners and other appropriate personnel deficiencies noted as a result of the monitoring process and recommendations for appropriate remedial action.

The firm’s evaluation of each type of deficiency should result in recommendations for one or more of the following:

• Taking appropriate remedial action in relation to an individual engagement or member of personnel;
• The communication of the findings to those responsible for training and professional development;
• Changes to the quality control policies and procedures; and
• Disciplinary action against those who fail to comply with the policies and procedures of the firm, especially those who do so repeatedly.

Firm should determine what further action is appropriate to comply with relevant professional standards and regulatory and legal requirements including obtaining legal advice.

At least annually, the firm should communicate the results of the monitoring of its quality control system to appropriate individuals within the firm, including the firm’s chief executive officer or, if appropriate, its managing partner(s) to enable them to take prompt and appropriate action necessary in accordance with their defined roles and responsibilities. Information communicated should include the following:

• A description of the monitoring procedures performed.
• The conclusions drawn from the monitoring procedures.
• Where relevant, a description of systemic, repetitive or other significant deficiencies and of the actions taken to resolve or amend those deficiencies.

Complaints and Allegations

Policies and procedures should be designed to provide it with reasonable assurance that it deals appropriately with:

• Complaints and allegations that the work performed by the firm fails to comply with professional standards and regulatory and legal requirements; and
• Allegations of non-compliance with the firm’s system of quality control.