|
QC Section 20—System of Quality Control for a CPA Firm's Accounting and Auditing Practice
QC Section 30—Monitoring a CPA Firm's Accounting and Auditing Practice
QC Section 40—The Personnel Management Element of a Firm's System of Quality Control-Competencies Required by a Practitioner-in-Charge of an Attest Engagement
QC Section 20
System of Quality Control for a CPA Firm's Accounting and Auditing Practice
(Supersedes sections 10 and 10-1)
Effective date: Applicable to a CPA firm's system of quality control for its accounting and auditing practice as of January 1, 1997, unless otherwise indicated.
|
Statements on Quality Control Standards are issued by the Auditing Standards Board. Firms that are enrolled in an Institute approved practice monitoring program are obligated to adhere to quality control standards established by the Institute. |
Introduction and Applicability
.01 This section provides that a CPA firm shall have a system of quality control for its accounting and auditing practice and describes elements of quality control and other matters essential to the effective design, implementation, and maintenance of the system.
.02 The AICPA Principles of Professional Conduct provide, among other things, that "members should practice in firms that have in place internal quality-control procedures to ensure that services are competently delivered and adequately supervised."fn 1 Because of the public interest in the services provided by and the reliance placed on the objectivity and integrity of CPAs, this section provides that a CPA firm shall have a system of quality control for its accounting and auditing practice.fn 2
System of Quality Control
.03 A firmfn 3 as a responsibility to ensure that its personnel fn 4 comply with the professional standards applicable to its accounting and auditing practice. A system of quality control is broadly defined as a process to provide the firm with reasonable assurance that its personnel comply with applicable professional standards and the firm's standards of quality.fn 5 The policies and procedures designed to implement the system in one segment of a firm's practice may be the same as, different from, or interrelated with the policies and procedures designed for another segment, but the purpose of the system is the same for all segments of a firm's practice.
.04 A firm's system of quality control encompasses the firm's organizational structure and the policies adopted and procedures established to provide the firm with reasonable assurance of complying with professional standards. The nature, extent, and formality of a firm's quality control policies and procedures should be appropriately comprehensive and suitably designed in relation to the firm's size, the number of its offices, the degree of authority allowed its personnel and its offices, the knowledge and experience of its personnel, the nature and complexity of the firm's practice, and appropriate cost-benefit considerations.
.05 Any system of quality control has inherent limitations that can reduce its effectiveness. Variance in an individual's performance and understanding of (a) professional requirements or (b) the firm's quality control policies and procedures affects the degree of compliance with a firm's prescribed quality control policies and procedures and, therefore, the effectiveness of the system.
.06 The system of quality control should provide the firm with reasonable assurance that the segments of the firm's engagements performed by its foreign offices or by its domestic or foreign affiliates or correspondents are performed in accordance with professional standards in the United States when such standards are applicable.
Quality Control Policies and Procedure
Elements of Quality Control
.07 The quality control policies and procedures applicable to a firm's accounting and auditing practice should encompass the following elements:
a. Independence, Integrity, and Objectivity
b. Personnel Management
c. Acceptance and Continuance of Clients and Engagements
d. Engagement Performance
e. Monitoring
.08 The elements of quality control are interrelated. For example, the maintenance of Integrity, Objectivity, and, where required, Independence requires a continuing assessment of client relationships. Similarly, the element of Personnel Management encompasses criteria for professional development, hiring, advancement, and assignment of the firm's personnel to engagements, which affect policies and procedures developed to meet the objectives of the quality control element of Engagement Performance. Similarly, policies and procedures for the quality control element of Monitoring are established to provide the firm with reasonable assurance that the policies and procedures related to each of the other elements of quality control are suitably designed and are being effectively applied.
Independence, Integrity, and Objectivity
.09 Policies and procedures should be established to provide the firm with reasonable assurance that personnel maintain independence (in fact and in appearance) in all required circumstances,fn 6 perform all professional responsibilities with integrity, and maintain objectivity in discharging professional responsibilities.
.10 Independence, Integrity, and Objectivity are defined and more fully described in the AICPA Code of Professional Conduct (the Code) and AU section 220, Independence. Rules 101 and 102 of the Code, and the related Interpretations and Rulings [ET sections 101, 102, and 191] contain examples of instances wherein a member's independence, integrity, and objectivity will be considered to be impaired. Independence encompasses an impartiality that recognizes an obligation for fairness not only to management and owners of a business but also to those who may otherwise use the firm's report. The firm and its personnel must be free from any obligation to or interest in the client, its management, or its owners.fn 7 Integrity requires personnel to be honest and candid within the constraints of client confidentiality. Service and the public trust should not be subordinated to personal gain and advantage. Objectivity is a state of mind and a quality that lends value to a firm's services. The principle of objectivity imposes the obligation to be impartial, intellectually honest, and free of conflicts of interest.
Personnel Management
.11 A firm's quality control system depends heavily on the proficiency of its personnel. In making assignments, the nature and extent of supervision to be provided should be considered. Generally, the more able and experienced the personnel assigned to a particular engagement, the less direct supervision is needed.
.12 The quality of a firm's work ultimately depends on the integrity, objectivity, intelligence, competence, experience, and motivation of personnel who perform, supervise, and review the work. Thus, a firm's personnel management policies and procedures factor into maintaining such quality.
.13 Personnel Management encompasses hiring, assigning personnel to engagements, professional development, and advancement activities. Accordingly, policies and procedures should be established to provide the firm with reasonable assurance that—
a. Those hired possess the appropriate characteristics to enable them to perform competently.
b. Work is assigned to personnel having the degree of technical training and proficiency required in the circumstances.
c. Personnel participate in general and industry-specific continuing professional education and other professional development activities that enable them to fulfill responsibilities assigned, and satisfy applicable continuing professional education requirements of the AICPA and regulatory agencies.fn 8
d. Personnel selected for advancement have the qualifications necessary for fulfillment of the responsibilities they will be called on to assume.
Acceptance and Continuance of Clients and Engagements
.14 Policies and procedures should be established for deciding whether to accept or continue a client relationship and whether to perform a specific engagement for that client. Such policies and procedures should provide the firm with reasonable assurance that the likelihood of association with a client whose management lacks integrity is minimized. Establishing such policies and procedures does not imply that a firm vouches for the integrity or reliability of a client, nor does it imply that a firm has a duty to any person or entity but itself with respect to the acceptance, rejection, or retention of clients. However, prudence suggests that a firm be selective in determining its client relationships and the professional services it will provide.
.15 Such policies and procedures should also provide reasonable assurance that the firm—
a. Undertakes only those engagements that the firm can reasonably expect to be completed with professional competence.
b. Appropriately considers the risks associated with providing professional services in the particular circumstances.
.16 To minimize the risk of misunderstandings regarding the nature, scope, and limitations of the services to be performed, policies and procedures should provide for obtaining an understanding with the client regarding those services. Professional standards may provide guidance in deciding whether the understanding should be oral or written.
Engagement Performance
.17 Policies and procedures should be established to provide the firm with reasonable assurance that the work performed by engagement personnel meets applicable professional standards, regulatory requirements, and the firm's standards of quality.
.18 Policies and procedures for Engagement Performance encompass all phases of the design and execution of the engagement. To the extent appropriate and as required by applicable professional standards, these policies and procedures should cover planning, performing, supervising, reviewing, documenting, and communicating the results of each engagement. Where applicable, these policies and procedures should also address the concurring partner review requirements applicable to SEC engagements as set forth in membership requirements of the SEC Practice Section of the AICPA. [As amended, applicable to a CPA firm's system of quality control for its accounting, auditing, and attestation practice as of January 1, 2000, by Statement on Quality Control Standards No. 4.]
.19 Policies and procedures should also be established to provide reasonable assurance that personnel refer to authoritative literature or other sources and consult, on a timely basis, with individuals within or outside the firm, when appropriate (for example, when dealing with complex, unusual, or unfamiliar issues). Individuals consulted should have appropriate levels of knowledge, competence, judgment, and authority. The nature of the arrangements for consultation depends on a number of factors, including the size of the firm and the levels of knowledge, competence, and judgment possessed by the persons performing the work.
Monitoring
.20 Policies and procedures should be established to provide the firm with reasonable assurance that the policies and procedures established by the firm for each of the other elements of quality control described in paragraphs .07 through .19 are suitably designed and are being effectively applied.fn 9 Monitoring involves an ongoing consideration and evaluation of the—
a. Relevance and adequacy of the firm's policies and procedures.
b. Appropriateness of the firm's guidance materials and any practice aids.
c. Effectiveness of professional development activities.
d. Compliance with the firm's policies and procedures. When monitoring, the effects of the firm's management philosophy and the environment in which the firm practices and its clients operate should be considered.
Administration of a Quality Control System
.21 To provide reasonable assurance that the firm's quality control system achieves its objectives, appropriate consideration should be given to the assignment of quality control responsibilities within the firm, the means by which quality control policies and procedures are communicated, and the extent to which the policies and procedures and compliance therewith should be documented.
Assignment of Responsibilities
.22 Responsibility for the design and maintenance of the various quality control policies and procedures should be assigned to an appropriate individual or individuals in the firm. In making that assignment, consideration should be given to the proficiency of the individuals, the authority to be delegated to them, and the extent of supervision to be provided. However, all of the firm's personnel are responsible for complying with the firm's quality control policies and procedures.
Communication
.23 A firm should communicate its quality control policies and procedures to its personnel in a manner that provides reasonable assurance that those policies and procedures are understood and complied with. The form and extent of such communications should be sufficiently comprehensive to provide the firm's personnel with an understanding of the quality control policies and procedures applicable to them. In addition, a firm should establish a means of communicating its established quality control policies and procedures, and the changes thereto, to appropriate personnel on a timely basis.
Documentation of Quality Control Policies and Procedures
.24 The size, structure, and nature of the practice of the firm should be considered in determining whether documentation of established quality control policies and procedures is required for effective communication and, if so, the extent of such documentation. For example, documentation of established quality control policies and procedures would generally be expected to be more extensive in a large firm than in a small firm and in a multioffice firm than in a single-office firm. Although communication ordinarily is enhanced if it is in writing, the effectiveness of a firm's system of quality control is not necessarily impaired by the absence of documentation of established quality control policies and procedures.
Documentation of Compliance with Quality Control Policies and Procedures
.25 A firm should prepare appropriate documentation to demonstrate compliance with its policies and procedures for the quality control system discussed herein. The form and content of such documentation is a matter of judgment and depends on a number of factors, such as the size of a firm, the number of offices, the degree of authority allowed its personnel and its offices, the nature and complexity of the firm's practice, its organization, and appropriate cost-benefit considerations. Documentation should be retained for a period of time sufficient to enable those performing monitoring procedures and a peer review to evaluate the extent of the firm's compliance with its quality control policies and procedures.
Effective Date
.26 The provisions of this section are applicable to a CPA firm's system of quality control for its accounting and auditing practice as of January 1, 1997.
QC Section 30
Monitoring a CPA Firm's Accounting and Auditing Practice
Effective date: Applicable to a CPA firm's system of quality control for its accounting and auditing practice as of January 1, 1997.
|
Statements on Quality Control Standards are issued by the Auditing Standards Board. Firms that are enrolled in an Institute approved practice monitoring program are obligated to adhere to quality control standards established by the Institute. |
Introduction
.01 This section provides guidance on how a CPA firm implements the monitoring element of a quality control system in its accounting and auditing practice.fn 1
.02 Section 20, System of Quality Control for a CPA Firm's Accounting and Auditing Practice, describes Monitoring as one of the five elements of quality control. It provides that a CPA firmfn 2 should establish policies and procedures to provide the firm with reasonable assurance that the policies and procedures relating to each of the other elements of quality control are suitably designed and are being effectively applied. Monitoring involves an ongoing consideration and evaluation of the—
a. Relevance and adequacy of the firm's policies and procedures.
b. Appropriateness of the firm's guidance materials and any practice aids.
c. Effectiveness of professional development activities.
d. Compliance with the firm's policies and procedures.
When monitoring, the effects of the firm's management philosophy and the environment in which the firm practices and its clients operate should be considered.
Monitoring Procedures
.03 Monitoring procedures taken as a whole should enable the firm to obtain reasonable assurance that its system of quality control is effective. Procedures that provide the firm with a means of identifying and communicating circumstances that may necessitate changes to or the need to improve compliance with the firm's policies and procedures contribute to the monitoring element. A firm's monitoring procedures may include—
· Inspection procedures. (See paragraphs .04 through .07.)
· Preissuance or postissuance review of selected engagements. (See paragraphs .08 and .09.)
· Analysis and assessment of—
— New professional pronouncements.
— Results of independence confirmations.
— Continuing professional education and other professional development activities undertaken by firm personnel.fn 3
— Decisions related to acceptance and continuance of client relationships and engagements.
— Interviews of firm personnel.
· Determination of any corrective actions to be taken and improvements to be made in the quality control system.
· Communication to appropriate firm personnel of any weaknesses identified in the quality control system or in the level of understanding or compliance therewith.
· Follow-up by appropriate firm personnel to ensure that any necessary modifications are made to the quality control policies and procedures on a timely basis.
.04 Inspection procedures evaluate the adequacy of the firm's quality control policies and procedures, its personnel's understanding of those policies and procedures, and the extent of the firm's compliance with its quality control policies and procedures. Inspection procedures contribute to the monitoring function because findings are evaluated and changes in or clarifications of quality control policies and procedures are considered.
.05 The need for and extent of inspection procedures depends in part on the existence and effectiveness of the other monitoring procedures. Factors to be considered in determining the need for and extent of inspection procedures include, but are not limited to—
· The nature, complexity, and diversity of, and the risks associated with, the firm's practice.
· The firm's size, number of offices, degree of authority allowed its personnel and its offices, and organizational structure.
· The results of recent practice reviews fn 4 and previous inspection procedures.
· Appropriate cost-benefit considerations.fn 5
.06 The nature of inspection procedures will vary based on the firm's quality control policies and procedures and the effectiveness and results of other monitoring procedures. The adequacy of and compliance with a firm's quality control system are evaluated by performing such inspection procedures as—
· Review of selected administrative and personnel records pertaining to the quality control elements.
· Review of engagement working papers, reports, and clients' financial statements. (See also paragraphs .08 and .09.)
· Discussions with the firm's personnel.
· Summarization of the findings from the inspection procedures, at least annually, and consideration of the systemic causes of findings that indicate improvements are needed.
· Determination of any corrective actions to be taken or improvements to be made with respect to the specific engagements reviewed or the firm's quality control policies and procedures.
· Communication of the identified findings to appropriate firm management personnel.
§ Consideration of inspection findings by appropriate firm management personnel who should also determine that any actions necessary, including necessary modifications to the quality control system, are taken on a timely basis.
Inspection procedures with respect to the engagement performance element of a quality control system are particularly appropriate in a firm with more than a limited number of management-level individualsfn 6 responsible for the conduct of its accounting and auditing practice.
.07 Inspection procedures may be performed at a fixed time(s) during the year covering a specified period(s) of time or as part of ongoing quality control procedures, or a combination thereof.
.08 Procedures for carrying out preissuance or postissuance review of engagement working papers, reports, and clients' financial statements by a qualified management-level individual (or by a qualified individual under his or her supervision) may be considered part of the firm's monitoring procedures provided that those performing or supervising such preissuance or postissuance reviews are not directly associated with the performance of the engagement. Such preissuance or postissuance review procedures may constitute inspection procedures provided—
a. The review is sufficiently comprehensive to enable the firm to assess compliance with all applicable professional standards and the firm's quality control policies and procedures.
b. Findings of such reviews that may indicate the need to improve compliance with or modify the firm's quality control policies and procedures are periodically summarized, documented, and communicated to the firm's management personnel having the responsibility and authority to make changes in those policies and procedures.
c. The firm's management personnel consider on a timely basis the systemic causes of findings that indicate improvements are needed and determine appropriate actions to be taken.
d. The firm implements on a timely basis such planned actions, communicates changes to personnel who might be affected, and follows up to determine that the planned actions were taken.
A preissuance and, except as described in paragraph .09, a postissuance review of engagement working papers, reports, and clients' financial statements by the person with final responsibility for the engagement does not constitute a monitoring procedure.
.09 In small firms with a limited number of qualified management-level individuals, postissuance review of engagement working papers, reports, and clients' financial statements by the person with final responsibility for the engagement may constitute inspection procedures, provided the provisions in paragraph .08a-d are followed. (See also paragraph .11.)
Monitoring in Small Firms with a Limited Number of Management-Level Individuals
.10 In small firms with a limited number of management-level individuals, monitoring procedures may need to be performed by some of the same individuals who are responsible for compliance with the firm's quality control policies and procedures. To effectively monitor one's own compliance with the firm's policies and procedures, an individual must be able to critically review his or her own performance, assess his or her own strengths and weaknesses, and maintain an attitude of continual improvement. Changes in conditions and in the environment within the firm (such as obtaining clients in an industry not previously serviced or significantly changing the size of the firm) may indicate the need to have quality control policies and procedures monitored by another qualified individual.
.11 The performance of inspection procedures in firms with a limited number of management-level individuals can assist the firm in the monitoring process. An individual inspecting his or her own compliance with a quality control system may be inherently less effective than having such compliance inspected by another qualified individual. When one individual inspects his or her own compliance, the firm may have a higher risk that noncompliance with policies and procedures will not be detected. Accordingly, a firm in this circumstance may find it beneficial to engage a qualified individual from outside the firm to perform inspection procedures.
The Relationship of Peer Review to Monitoring
.12 A peer review does not substitute for monitoring procedures. However, since the objective of a peer review is similar to that of inspection procedures, a firm's quality control policies and procedures may provide that a peer review conducted under standards established by the AICPA may substitute for some or all of its inspection procedures for the period covered by the peer review.
Effective Date
.13 The provisions of this section are applicable to a CPA firm's system of quality control for its accounting and auditing practice as of January 1, 1997.
QC Section 40
The Personnel Management Element of a Firm's System of Quality Control-Competencies Required by a Practitioner-in-Charge of an Attest Engagement
Introduction
.01 Section 20, System of Quality Control for a CPA Firm's Accounting and Auditing Practice, provides that a CPA firm shall have a system of quality control for its accounting and auditing practicefn 1 that should encompass the following elements:
a. Independence, integrity, and objectivity
b. Personnel management
c. Acceptance and continuance of clients and engagements
e. Engagement performance
f. Monitoring
The Personnel Management Element of Quality Control
.02 Personnel Management encompasses hiring, assigning personnel to engagements, professional development, and advancement activities. Accordingly, policies and procedures should be established to provide the firm with reasonable assurance that—
a. Those hired possess the appropriate characteristics to enable them to perform competently. Examples of such characteristics may include meeting minimum academic requirements established by the firm, maturity, integrity, and leadership traits.
b. Work is assigned to personnel having the degree of technical training and proficiency required in the circumstances.
c. Personnel participate in general and industry-specific continuing professional education and other professional development activities that enable them to fulfill responsibilities assigned, and satisfy applicable continuing professional education requirements of the AICPA, and regulatory agencies.fn 2
d. Personnel selected for advancement have the qualifications necessary for fulfillment of the responsibilities they will be called on to assume.
.03 This section clarifies the requirements of the personnel management element of a firm's system of quality control. In light of the significant responsibilities during the planning and performance of accounting, auditing, and attestation engagements of individuals who are responsible for supervising accounting, auditing, and attestation engagements and signing or authorizing an individual to sign the accountants report on such engagements, a firm's policies and procedures related to the items noted in paragraph .02 above should be designed to provide a firm with reasonable assurance that such individuals possess the kinds of competencies that are appropriate given the circumstances of individual client engagements. For purposes of this standard, such an individual is referred to as the practitioner-in-charge of the engagement.
Competencies
.04 Competencies are the knowledge, skills, and abilities that enable a practitioner-in-charge to be qualified to perform an accounting, auditing, or attestation engagement. A firm is expected to determine the kinds of competencies that are necessary in the individual circumstances. Competencies are not measured by periods of time because such a quantitative measurement may not accurately reflect the kinds of experiences gained by a practitioner in any given time period. Accordingly, for purposes of this section, a measure of overall competency is qualitative rather than quantitative.
Gaining Competencies
.05 A firm's policies and procedures would ordinarily require a practitioner-in-charge of an engagement to gain the necessary competencies through recent experience in accounting, auditing, and attestation engagements. In some cases, however, a practitioner-in-charge will have obtained the necessary competencies through disciplines other than the practice of public accounting, such as in relevant industry, governmental, and academic positions. If necessary, the experience of the practitioner-in-charge should be supplemented by continuing professional education (CPE) and consultation. The following are examples.
· A practitioner-in-charge of an engagement whose recent experience has consisted primarily in providing tax services may acquire the competencies necessary in the circumstances to perform a compilation or review engagement by obtaining relevant CPE.
· A practitioner-in-charge of an engagement who did not have any experience in auditing the financial statements of a public company and only possessed recent prior experience in auditing the financial statements of nonpublic entities may develop the necessary competencies by obtaining relevant CPE related to SEC rules and regulations and consulting with other practitioners who possess relevant knowledge related to SEC rules and regulations.
· A practitioner-in-charge of an engagement who did not have any experience in auditing the financial statements of a public company but possessed prior public accounting practice experience auditing financial statements of nonpublic entities and who also has relevant experience as the controller of a public company may have the necessary competencies in the circumstances.
· A practitioner-in-charge of an engagement whose actual experience consists of performing review and compilation engagements may be able to obtain the necessary competencies to perform an audit by becoming familiar with the industry in which the client operates, obtaining continuing professional education relating to auditing, and/or using consulting sources during the course of performing the audit engagement
· A person in academia might obtain the necessary competencies to perform accounting, auditing or attestation engagements by (a) obtaining specialized knowledge through teaching or authorship of research projects or similar papers, and (b) a rigorous self-study program or by engaging a consultant to assist on such engagements.
.06 Regardless of the manner in which a particular competency is gained, a firm's quality control policies and procedures should be adequate to provide reasonable assurance that a practitioner-in-charge of an engagement possesses the competencies necessary to fulfill his or her engagement responsibilities.
.07 The nature and extent of competencies established by a firm that are expected of the practitioner-in-charge of an engagement should be based on the characteristics of a particular client, industry, and the kind of service being provided. For example, the following should be considered.
· The competencies expected of a practitioner-in-charge of an engagement to compile financial statements would be different than those expected of a practitioner engaged to review or audit financial statements.
· Supervising engagements and signing or authorizing others to sign reports for clients in certain industries or engagements, such as financial services, governmental, or employee benefit plan engagements, would require different competencies than what would be expected in performing attest services for clients in other industries.
· The practitioner-in-charge of an engagement to audit the financial statements of a public company would be expected to have certain technical proficiency in SEC reporting requirements, while a practitioner-in-charge who is not assigned to the audits of public companies would not need to be proficient in this area. This would include, for example, experience in the industry and appropriate knowledge of SEC and ISB rules and regulations, including accounting and independence standards.
· The practitioner-in-charge of an attestation engagement to examine management's assertion about the effectiveness of an entity's internal control over financial reporting would be expected to have certain technical proficiency in understanding and evaluating the effectiveness of controls, while a practitioner-in-charge of an attestation engagement to examine investment performance statistics would be expected to have different competencies, including an understanding of the subject matter of the underlying assertion.
Competencies Expected in Performing Accounting, Auditing, and Attestation Engagements
.08 In practice, the kinds of competency requirements that a firm should establish for the practitioner-in-charge of an engagement are necessarily broad and varied in both their nature and number. However, the firm's quality control policies and procedures should ordinarily address the following competencies for the practitioner-in-charge of an engagement. Firms policies and procedures should also address other competencies as necessary in the circumstances.
— Understanding of the Role of a System of Quality Control and the Code of Professional Conduct—Practitioners-in-charge of an engagement should possess an understanding of the role of a firm's system of quality control and the AICPA's Code of Professional Conduct, both of which play critical roles in assuring the integrity of the various kinds of accountant's reports.
— Understanding of the Service to be Performed—Practitioners-in-charge of an engagement should possess an understanding of the performance, supervision, and reporting aspects of the engagement, which is normally gained through actual participation in that kind of engagement under appropriate supervision.
— Technical Proficiency—Practitioners-in-charge of an engagement should possess an understanding of the applicable accounting, auditing, and attest professional standards including those standards directly related to the industry in which a client operates and the kinds of transactions in which a client engages.
|