leadership responsibilities for quality within the …...a. leadership responsibilities for quality...

1

AICPA Peer Review Program

GUIDELINES FOR REVIEW OF QUALITY CONTROL POLICIES AND PROCEDURES

FOR FIRMS WITH TWO OR MORE PERSONNEL1

Firm Prepared By Date

.01 This questionnaire should be completed by the reviewer when evaluating the design of and compliance with the firm’s quality control policies and procedures. The questionnaire has been developed for firms with two or more personnel. .02 In evaluating the design of the firm’s quality control policies and procedures, the reviewer will consider whether certain policies and procedures have been implemented by the firm. It is expected that a firm may achieve the objectives detailed in this questionnaire without implementing all of these quality control policies and procedures. .03 In cases where a policy or procedure in this questionnaire has not been implemented by a firm, the reviewer will assess whether compensating controls are present at the firm to mitigate any potential resultant risks.

Leadership Responsibilities for Quality Within the Firm (“Tone at the Top”)

Evaluating the Design of the Firm’s Quality Control Policies and Procedures

Objective

Determine whether the firm’s policies and procedures relative to leadership responsibilities for quality within the firm (“Tone at the Top”) are designed to promote an internal culture based on the recognition that quality is essential in performing engagements.

Procedures

1. Assess the design of the firm’s quality control policies and procedures by obtaining and reviewing the firm’s documented policies and procedures.

2. Document “no” answers in appendix A.

Policies and Procedures

Did the firm’s docu-mented QCPP include

this policy during peer review year?

Yes No2

A. Leadership Responsibilities for Quality Within the Firm (“Tone at the Top”)

The firm should document its policies and procedures and communicate them to the firm’s personnel (QC sec. 10 par. .18)

1 The term personnel is defined in QC section 10, A Firm’s System of Quality Control (AICPA, Professional Standards) as all individuals who perform professional services for which the firm is responsible, whether or not they are CPAs (including leased and per diem employees who de-vote at least 25 percent of their time at the reviewed firm in performing audits, reviews, compilations, or attestation engagements, or those profes-sionals who have the partner-level or manager-level responsibility for the overall supervision or review of such engagements). 2 Document disposition of “no” answers in appendix A.

2


Did the firm’s docu-mented QCPP include

this policy during peer review year?

Yes No2

1. The firm must document all of its quality control policies and procedures and keep that documentation up to date.

2. New hires are required to acknowledge receipt of the firm’s quality control docu-ment in writing.

3. At least annually, firm personnel receive training on the firm’s quality control pol-icies and procedures.

The firm should establish policies and procedures designed to promote an internal culture based on recognition that quality is essential in performing engagements. Such policies and procedures should require the firm’s leadership (managing part-ner or board of managing partners, CEO, or equivalent) to assume ultimate respon-sibility for the firm’s system of quality control. (QC sec. 10 par. 19)

4. The firm’s leadership promotes an internal culture based on recognition that quali-ty is essential in performing engagements.

5. At least annually, firm leadership explicitly communicates the importance of qual-ity to firm personnel.

6. The firm’s management assumes ultimate responsibility for the firm’s system of quality control.

7. The firm assigns management responsibilities so that commercial considerations do not override the quality of work performed.

The firm should establish policies and procedures designed to provide it with rea-sonable assurance that any person or persons assigned operational responsibility for the firm’s system of quality control by the firm’s leadership has sufficient and ap-propriate experience and ability, and the necessary authority, to assume that respon-sibility. (QC sec. 10 par. 20)

8. The firm assigns operational responsibility for its system of quality control to per-sonnel who have sufficient and appropriate experience and ability to identify and understand quality control issues and to develop appropriate policies and proce-dures, as well as the necessary authority to implement those policies and proce-dures.

Evaluating the Firm’s Compliance with Quality Control Policies and Procedures

Objective

Determine whether the firm’s policies and procedures relative to leadership responsibilities for quality within the firm (“Tone at the Top”) are being complied with to promote an internal culture based on the recognition that quality is essential in performing engagements.

Procedures

1. After evaluating the design of the firm’s system of quality control, develop a plan for the nature and extent of compliance testing. The number and type of tests should be based upon the reviewer’s assessment of peer re-view risk.

3

2. If any of the firm’s policies were not complied with during the peer review year, those should be documented in appendix A.

Did the firm com-ply with this poli-

cy during peer review year?

Policy # Description of procedures performed to test compliance and results Yes No

Conclusion

Yes No

Are the firm’s policies and procedures relative to leadership responsibilities for quality within the firm (the “Tone at the Top”) designed and being com-plied with to promote an internal culture based on the recognition that quali-ty is essential in performing engagements?

4

Relevant Ethical Requirements


Objective

Determine whether the firm’s policies and procedures relative to relevant ethical requirements are designed to provide it with reasonable assurance that the firm and its personnel comply with relevant ethical requirements.

Procedures




Did the firm’s docu-mented QCPP include this policy during peer

review year?

Yes No3

B. Relevant Ethical Requirements

The firm should establish policies and procedures designed to provide it with rea-sonable assurance that the firm and its personnel comply with relevant ethical re-quirements. (QC sec. 10 par. 21)

1. The firm documents and communicates its policies and procedures for relevant ethical requirements to its personnel.

2. The firm maintains access to current guidance materials regarding the applicable independence, integrity, and objectivity requirements.

3. The firm has assigned an individual with responsibility for providing guidance, answering questions, monitoring compliance, and resolving matters with respect to independence, integrity, and objectivity.

4. The firm ensures the independence of the firm as required by the AICPA, state CPA societies, state boards of accountancy, state statute, the SEC, and other reg-ulatory bodies, if applicable.

5. The firm informs its personnel of the types of financial or other relationships that

may impair independence and that may be prohibited.

6. Engagement partners must provide the firm with relevant information about cli-ent engagements, including scope of services, to enable the firm to evaluate the overall effect, if any, on independence requirements.

7. The firm provides its personnel with the list of clients and any related entities and informs them on a timely basis as to any changes in the firm’s clients and any re-lated entities to which independence policies apply.

3 Document disposition of “no” answers in appendix A.

5



review year?

Yes No3

8. The firm obtains written confirmation, upon hire and on an annual basis, of com-pliance with its policies and procedures on independence from all personnel re-quired to be independent by relevant requirements. (If “no,” the firm may not be in compliance with QC section 10, which requires written confirmation, at least annually.)

9. If the firm accepts an engagement where it acts as principal auditor or accountant and another firm of CPAs is engaged to perform segments of the engagement, written confirmations are obtained regarding the other firm’s independence with respect to audit engagements and either written or oral confirmations obtained for review or attestation engagements.

10. The firm accumulates and communicates relevant information to appropriate per-sonnel so that the firm and its personnel can readily determine whether they satis-fy independence requirements; the firm can maintain and update information relating to independence; and the firm can take appropriate action regarding iden-tified threats to independence that are not at an acceptable level.

11. If the firm identifies circumstances or relationships that create threats to inde-pendence, the firm evaluates those threats and takes appropriate action to elimi-nate them or reduce them to an acceptable level by applying safeguards; or, if considered appropriate, withdraws from the engagement when withdrawal is pos-sible under applicable law or regulation.

12. The firm evaluates other possible threats to independence and objectivity, includ-ing the familiarity threat that may be created by using the same senior personnel on an audit or attest engagement over a long period of time. When a familiarity threat is identified, the firm takes appropriate actions to eliminate those threats or reduce them to an acceptable level by applying safeguards.

13. If the firm identifies circumstances for which documentation of the resolution of independence, integrity, and objectivity questions is required, such documentation is retained for a specified period of time.

14. The firm has established criteria for determining when it is necessary to consult with individuals outside the firm on independence, integrity, or objectivity con-cerns.

15. The firm designates responsibility to appropriate personnel for periodically re-viewing unpaid fees from clients to ascertain whether any outstanding amounts may impair the firm’s independence.

16. If the firm provides nonattest services to accounting and auditing clients, the firm must meet all the requirements of Ethics Interpretation No. 101-3 for all such cli-ents.

17. If the firm becomes a member of a network [ET sec. 92 par. .22], the firm will

6



review year?

Yes No3

i. meet all of the requirements of Ethics Interpretation No. 101-17.

ii. monitor its independence with respect to financial statement audits, re-views, and other attest engagements performed by other members of the network.

The firm should establish policies and procedures designed to provide it with rea-sonable assurance that it is notified of breaches of independence requirements and to enable it to take appropriate actions to resolve such situations. (QC sec. 10 par. 24)

18. Personnel must promptly notify the firm of independence breaches of which they become aware and the firm must take appropriate actions to resolve such situa-tions.

19. The firm promptly communicates identified breaches of independence policies and procedures to

a. the engagement partner who, with the firm, must address the breach and communicate actions taken to resolve the matter to the firm.

b. other relevant personnel in the firm and, when appropriate, the network and those subject to the independence requirements, who must take appropriate action to resolve the matter and communicate those actions to the firm.


Objective

Determine whether the firm’s policies and procedures relative to relevant ethical requirements are being complied with to provide it with reasonable assurance that the firm and its personnel comply with relevant ethical requirements.

Procedures






7




Conclusion

Yes No

Are the firm’s policies and procedures relative to relevant ethical require-ments designed and being complied with to provide it with reasonable assur-ance that the firm and its personnel comply with relevant ethical requirements?

8

Acceptance and Continuance of Client Relationships and Specific Engagements


Objective

Determine whether the firm’s policies and procedures relative to Acceptance and Continuance of Client Relationships and Specific Engagements are designed to provide the firm with reasonable assurance that it will undertake or contin-ue relationships and engagements only when the firm

is competent to perform the engagement and has the capabilities, including time and resources, to do so;

can comply with legal and relevant ethical requirements; and

has considered the integrity of the client and does not have information that would lead it to conclude that the client lacks integrity.

Procedures




Did the firm’s documented QCPP include this policy during peer re-

view year?

Yes No4

C. Acceptance and Continuance of Client Relationships and Specific Engagements

The firm should establish policies and procedures for the acceptance and continuance of client relationships and specific engagements, de-signed to provide the firm with reasonable assurance that it will un-dertake or continue relationships and engagements only when the firm is competent to perform the engagement and has the capabilities, in-cluding time and resources, to do so; can comply with legal and rele-vant ethical requirements; and has considered the integrity of the client and does not have information that would lead it to conclude that the client lacks integrity. (QC sec. 10 par. .27)

1. The firm documents and communicates its policies and procedures to personnel for accepting prospective clients and the continuance of current clients and specific engagements.

2. The firm will only undertake or continue relationships and engage-ments where it has considered the integrity of the client, is compe-tent to perform the engagement, and can comply with the legal and ethical requirements.

3. Before accepting or continuing a client relationship, the firm must

a. Evaluate the nature of the services to be provided and the integ-rity of the client, including the following:


9



view year?

Yes No4

i. The nature and purpose of the services to be provided to the client and management’s understanding thereof

ii. The identity of the client’s principal owners, key manage-ment, related parties, and those charged with governance

iii. The nature of the client’s operations, including its business practices, from sources such as annual reports, interim fi-nancial statements, reports to and from regulators, income tax returns, and credit reports

iv. Information obtained from third parties (bankers, factors, attorneys, credit services, and others who have business re-lationships with the entity), where appropriate based on the size and nature of the client

v. Information concerning the attitude of the client’s principal owners, key management, and those charged with govern-ance toward such matters as aggressive interpretation of accounting standards and internal control over financial reporting

vi. Communications with the predecessor accountant or audi-tor when required by professional standards. Such com-munications should include inquiries regarding the nature of any disagreements and other events, the reasons for the change and whether evidence of “opinion shopping” ex-ists.

vii. Background checks of the business, its officers, and so on

b. Documents an assessment of the firm’s competence, capabili-ties and resources to undertake the engagement, including whether

i. firm personnel have knowledge of relevant industries or subject matters or the ability to effectively gain the neces-sary knowledge;

ii. firm personnel have experience with relevant regulatory or reporting requirements or the ability to effectively gain the necessary competencies;

iii. the firm has sufficient personnel with the necessary com-petence and capabilities;

iv. specialists are available, if needed;

v. individuals meeting the criteria and eligibility require-ments to perform an engagement quality control review are available, when applicable; and

vi. the firm is able to complete the engagement within the re-porting deadline.

10



view year?

Yes No4

c. Documents an assessment of the risks associated with the en-gagement, including whether

i. the prospective client operates in a highly specialized or regulated industry;

ii. there may be substantial doubt about the entity’s ability to continue as a going concern;

iii. the entity is in the development stage;

iv. the engagement will require an inordinate amount of time to complete relative to the available resources of the firm;

v. the engagement would be with significant client or other client for which the firm’s objectivity or the appearance of independence may be impaired; and

vi. additional firm and individual licenses may be needed for states other than where the firm’s main office is domiciled or for states other than where an individual primarily prac-tices.

4. When issues have been identified relative to Ethics Interpretation 102-2, “Conflicts of Interest,” and the firm decides to accept or con-tinue the client relationship or a specific engagement, the firm doc-uments how the issues were resolved.

5. The firm designates individuals to evaluate and make recommenda-tions as to whether a client or specific engagement should be ac-cepted or continued.

a. The designated individuals will

i. Evaluate all the information obtained about the client or engagement and make a recommendation about whether the client or engagement should be accepted or continued.

ii. Document the decision and have an individual at an appro-priate level approve the decision.

The firm should establish policies and procedures on continuing an engagement and the client relationship that address the circumstances when the firm obtains information that would have caused it to decline the engagement had that information been available earlier. (QC sec. 10 par. .30)

6. The firm specifies conditions that require evaluation of an existing client or engagement, obtaining relevant information to determine whether the relationship should be continued, and establishing a specific time period to make and document that evaluation.

11



view year?

Yes No4

a. The conditions include the following:

i. Significant changes in the client, such as a major change in senior client personnel, ownership, advisors, nature of its business, or its financial stability

ii. Changes in the nature or scope of the engagement, includ-ing requests for additional services

iii. Changes in the composition of the firm, such as the loss of and inability to replace key personnel who are particularly knowledgeable about a specialized industry

iv. The decision to discontinue services to clients in a particu-lar industry

v. The existence of conditions that would have caused the firm to reject the client or engagement had such conditions exist-ed at the time of the initial acceptance

vi. The client’s delinquency in paying fees

vii. The client has ignored prior recommendations, such as those that address deficiencies in internal control

7. The firm establishes procedures for withdrawal from an engage-ment or from both the engagement and the client relationship.

8. If the firm considers discontinuing any audit and accounting client relationships but decides to continue, the factors considered in de-termining that the relationship should be continued are documented.


Objective

Determine whether the firm’s policies and procedures relative to Acceptance and Continuance of Client Relationships and Specific Engagements are being complied with to provide the firm with reasonable assurance that it will under-take or continue relationships and engagements only when the firm



has considered the integrity of the client and does not have information that would lead it to conclude that the client lacks integrity.

Procedures



12




Conclusion

Yes No

Are the firm’s policies and procedures relative to acceptance and continu-ance of client relationships and specific engagements designed and being complied with to provide the firm with reasonable assurance that it will un-dertake or continue relationships and engagements only when the firm



has considered the integrity of the client and does not have infor-mation that would lead it to conclude that the client lacks integrity.

13

Human Resources


Objective

Determine whether the firm’s policies and procedures relative to human resources are designed to provide the firm with reasonable assurance that it has sufficient personnel with the competence, capabilities, and commitment to ethi-cal principles necessary to

perform engagements in accordance with professional standards and applicable legal and regulatory re-quirements, and

enable the firm to issue reports that are appropriate in the circumstances.

Procedures





view year?

Yes No5

D. Human Resources

The firm should establish policies and procedures designed to provide it with reasonable assurance that it has sufficient personnel with the competence, capabilities, and commitment to ethical principles neces-sary to perform engagements in accordance with professional stand-ards and applicable legal and regulatory requirements and enable the firm to issue reports that are appropriate in the circumstances. (QC sec. 10 par. .31)

1. The firm has an individual or individuals responsible for the firm’s hiring and human resources management, including evaluation of personnel needs, establishment of hiring objectives, and providing final approval.

2. The firm has criteria for determining which individuals will be in-volved in the interviewing and hiring process.

3. The firm establishes hiring criteria that addresses the following:

i. Attributes, achievements, and experiences desired in entry-level and experienced personnel

to enable them to perform

competently within the firm

ii. How the firm evaluates personal characteristics such as integrity, competence, and motivation of new hires


14



view year?

Yes No5

iii. Any additional information the firm requires for experi-enced hires,

such as background checks and inquiries about

any outstanding regulatory actions

4. The firm has an orientation and training policy for new hires.

5. The firm encourages personnel to pass the Uniform CPA Examina-

tion and to participate in other professional development activities, such as taking graduate-level courses, becoming members of pro-fessional organizations, serving on professional committees, and writing for professional publications.

6. The firm has an individual or individuals responsible for the firm’s CPE and professional development activities, including maintaining CPE records and course materials for personnel.

7. The firm provides CPE to personnel in subjects that are relevant to their responsibilities.

8. The firm establishes CPE requirements for personnel. Under these requirements,

a. all personnel must participate in CPE and professional devel-opment activities that support their performance of the engage-ments they are assigned and are appropriate when considering their role in the firm.

b. If an individual signs opinions on or manages must-select en-gagements, the individual must have a minimum of eight hours of CPE specific to the must-select industry or area every three years (or within the firm’s or individual’s CPE period covering a three-year period).

c. All personnel must take at least two hours of ethics CPE every 24 months.

9. All personnel must comply with the professional education require-ments of the board(s) of accountancy in state(s) where they are li-censed, the AICPA (if applicable), the state CPA society (if applicable), and Government Auditing Standards—the Yellow Book (if applicable).

10. When the firm accepts an audit in an industry that the firm’s per-sonnel have not audited in the preceding five years, the firm re-quires all senior members of the engagement team to take industry-specific CPE before planning procedures are performed.

11. The firm informs personnel of changes in accounting and auditing

standards, independence, integrity, and objectivity requirements and the firm’s technical policies and procedures with respect to them (for example, by distributing technical pronouncements and holding training courses on recent changes and areas noted by the firm as needing improvement).

15



view year?

Yes No5

The firm’s policies and procedures should provide that personnel se-lected for advancement have the qualifications necessary for fulfill-ment of the responsibilities that they will be called on to assume. (QC sec. 10 par. .32)

12. The firm designs procedures addressing personnel performance evaluation, compensation, and advancement to demonstrate the firm’s overarching commitment to quality.

13. The firm has different levels of responsibility within the firm (for example, partner, manager, and senior).

14. The firm establishes, documents, communicates and assures adher-ence to evaluation and advancement criteria for personnel at all lev-els.

15. The firm establishes compensation and advancement criteria for partners and senior-level staff that addresses the following:

a. Feedback based on monitoring results, peer reviews, and regu-latory inspections

b. Appropriate identification of significant and emerging account-ing and auditing issues

c. Appropriate consultation with firm experts when challenging issues arise

16. The firm designates an individual with responsibility for

a. making advancement and termination decisions, including identifying responsibilities and requirements for evaluation at each level and deciding who will prepare evaluations.

b. developing the evaluation form for each professional classifica-tion, including partners.

17. The firm designates responsibility for periodically evaluating the performance of personnel and advising them of their progress in the firm.

18. At least annually, the firm summarizes and reviews with personnel the evaluation of their performance, including an assessment of their knowledge, skills and abilities (competencies), and progress with the firm, that includes a discussion regarding performance, fu-ture objectives of the firm and the individual, assignment prefer-ences, and career opportunities.

16



view year?

Yes No5

The firm should assign responsibility for each engagement to an en-gagement partner and should establish policies and procedures requir-ing that the identity and role of the engagement partner are communicated to management and those charged with governance; the engagement partner has the appropriate competence, capabilities, and authority to perform the role; and the responsibilities of the en-gagement partner are clearly defined and communicated to that indi-vidual. (QC sec. 10 par. .33)

19. The identity and role of the engagement partner must be communi-cated to management and those charged with governance.

20. The firm specifies the knowledge, skills, and abilities (competen-cies) that the practitioner in charge of the firm’s accounting, audit-ing, or attestation engagements (the partner or other person who is responsible for supervising those types of engagements and signing or authorizing someone to sign the accountant’s report on such en-gagements) should possess to fulfill his or her engagement respon-sibilities.

a. Such competencies for the practitioner-in-charge include the following:

i. An understanding of the role of the firm’s system of quali-ty control and the AICPA Code of Professional Conduct

ii. An understanding of the performance, supervision, and reporting aspects of the engagement

iii. An understanding of the applicable accounting, auditing, or attestation professional standards, including those standards directly related to the industry in which a client operates

iv. An understanding of the industry in which a client oper-ates, including the industry’s organization and operating characteristics, to identify the areas of high or unusual risk associated with an engagement, and to evaluate the reason-ableness of industry-specific estimates

v. Skills that indicate sound professional judgment

vi. An understanding of how organizations are dependent on or enabled by information technologies, and the manner in which information systems are used to record and maintain financial information

21. The firm periodically evaluates all personnel, including owners, who sign reports on behalf of the firm to assess whether they possess the knowledge, skills, and abilities (competencies) necessary to enable them to be qualified to perform the firm’s accounting, auditing, or at-testation engagements (for example, by means of counseling, peer evaluation or self-appraisal).

17



view year?

Yes No5

22. When an engagement is found to be materially non-conforming af-ter report issuance (for example, through firm monitoring, peer re-view or regulatory inspection), the firm either (a) requires the engagement partner to take relevant CPE and requires EQCR on the engagement partner’s future engagements in that industry or area, (b) prohibits the engagement partner from performing future en-gagements in that industry or area, or (c) dismisses the engagement partner.

The firm should establish policies and procedures to assign appropri-ate personnel with the necessary competence and capabilities to per-form engagements in accordance with professional standards and applicable legal and regulatory requirements and enable the firm to issue reports that are appropriate in the circumstances. (QC sec. 10 par. .34)

23. The firm ensures personnel assigned to engagements have the degree of

technical training and proficiency required in the circumstances consid-ering the nature and extent of supervision to be provided.

a. To meet that objective, the firm:

i. designates a responsible party for the assignment of per-sonnel

to engagements.

ii. considers each of the following factors to determine how personnel

are assigned to engagements: engagement size

and complexity; specialized experience or expertise re-quired; personnel availability and involvement of supervi-sory personnel; timing of the work to be performed; continuity and rotation of personnel; opportunities for on-the-job training; previous knowledge; skills and abilities [competencies] gained through other experience; and situa-tions where independence or objectivity concerns exist.

iii. documents its review of the competence and capabilities of each engagement team, including the factors listed in QC section 10 par. .A11, and the engagement partner approves the composition of the engagement team before any proce-dures are performed.

24. The firm assures that individuals are maintaining the appropriate li-censes to perform the engagements they are assigned, including for states other than where the individual primarily practices public ac-counting.

25. When the firm accepts an audit in an industry that the firm’s per-sonnel have not audited in the preceding five years, the firm engag-es a suitably qualified external person to assist with the performance of an audit as a member of the engagement team.

18


Objective

Determine whether the firm’s policies and procedures relative to human resources are being complied with to provide the firm with reasonable assurance that it has sufficient personnel with the competence, capabilities, and commitment to ethical principles necessary to

perform engagements in accordance with professional standards and applicable legal and regulatory re-quirements, and

enable the firm to issue reports that are appropriate in the circumstances.

Procedures






Conclusion

Yes No

Are the firm’s policies and procedures relative to human resources designed and being complied with to provide the firm with reasonable assurance that it has sufficient personnel with the competence, capabilities, and commitment to ethical principles necessary to

perform engagements in accordance with professional standards and applicable legal and regulatory requirements, and

enable the firm to issue reports that are appropriate in the circum-

19

Yes No

stances.

20

Engagement Performance


Objective

Determine whether the firm’s policies and procedures relative to engagement performance are designed to provide the firm with reasonable assurance of performing and reporting in conformity with applicable professional standards.

Procedures





view year?

Yes No6

E. Engagement Performance

The firm should establish policies and procedures designed to provide it with reasonable assurance that engagements are consistently per-formed in accordance with professional standards and applicable legal and regulatory requirements and that the firm issues reports that are appropriate in the circumstances. (QC sec. 10 par. .35)

1. If the firm develops its own quality control materials (QCM) (for ex-ample, an audit and accounting manual, standardized forms, check-lists, templates, practice aids, tools, questionnaires and the like) to assist with engagement performance, the firm has established policies and procedures for

i. developing materials that are reliable and suitable for the firm’s practice.

ii. maintaining the reliability and suitability of the materials through updates and revisions.

2. If the firm uses third-party QCM (for example, an audit and ac-counting manual, standardized forms, checklists, templates, practice aids, tools, questionnaires, and the like) to assist with engagement performance, the firm has established policies and procedures for

i. identifying and adopting materials that are reliable, modi-fying as necessary to make them suitable for the firm’s practice.

ii. maintaining the reliability and suitability of the materials through updates and revisions.

3. Written programs tailored to each specific engagement are required to be used on all engagements. The programs must be reviewed and approved by someone with appropriate authority.


21



view year?

Yes No6

4. To promote consistency, working papers must adhere to certain form and content requirements, such as including purchased prac-tice aids, as well as standardized forms, checklists, and question-naires, that are to be used in engagement performance evaluations.

5. Each engagement is required to be supervised by suitably experi-enced engagement team members.

a. Engagement supervision includes the following:

i. Tracking the progress of the engagement;

ii. Considering the competence and capabilities of individual members of the engagement team, whether they have suf-ficient time to carry out their work, whether they under-stand their instructions, and whether the work is being carried out in accordance with the planned approach to the engagement;

iii. Addressing significant findings and issues arising during the engagement, considering their significance, and modi-fying the planned approach appropriately; and

iv. Identifying matters for consultation or consideration by more experienced engagement team members during the engagement.

7. The firm assigns responsibility for review of all reports, financial statements, and working papers to a reviewer who is senior (when possible) to the preparer. All reviewers must have appropriate expe-rience, competence, and responsibility. The extent of engagement reviews is required to be documented.

a. That review is designed to obtain reasonable assurance of the following:

i. The work has been performed in accordance with profes-sional standards and applicable legal and regulatory re-quirements.

ii. Significant findings and issues have been raised for further consideration.

iii. Appropriate consultations have taken place and the result-ing conclusions have been documented and implemented.

iv. The nature, timing, and extent of the work performed is appropriate and without need for revision.

v. The work performed supports the conclusions reached and is appropriately documented.

vi. The evidence obtained is sufficient and appropriate to sup-port the report.

22



view year?

Yes No6

vii. The objectives of the engagement procedures have been achieved.

viii. The engagement team completed the assembly of final engagement files on time.

8. The firm requires that a partner of the firm ultimately be responsible for each engagement (certain standards may require partner respon-sibility).

9. If the firm practices in a must-select industry or area, a partner is designated with firm-wide responsibility for the quality of the firm’s practice in that area. That partner must take annual CPE in the must-select industry or area.

10. The firm establishes documented procedures to follow when the firm uses other offices or correspondents for audit or accounting engagements.

a. Those procedures address the following:

i. The form in which instructions are given to other offices or correspondents, and

ii. The extent to which their work is reviewed.

11. The firm maintains the appropriate firm license(s), including states other than where its main office is domiciled.

a. In all states where the firm practices, the firm

i. is licensed under the same name(s) under which it practices;

ii. must obtain license(s) which are effective before any re-ports are issued in the state;

iii. considers variations in licensing bodies’ rules and regula-tions and how they impact the firm’s need to be licensed in that state; and

iv. addresses any restrictions on practice imposed by the li-censing bodies.

The firm should establish policies and procedures designed to provide it with reasonable assurance that consultation takes place on difficult or contentious issues; sufficient resources are available to enable ap-propriate consultation to take place; the nature and scope of such con-sultations are documented and are agreed upon by both the individual seeking consultation and the individual consulted; and the conclu-sions resulting from consultations are documented, understood by both the individual seeking consultation and the individual consulted, and implemented (QC sec. 10 par. .37)

12. The firm informs personnel of its consultation policies and proce-dures.

23



view year?

Yes No6

13. The firm identifies circumstances, including specialized situations, when firm personnel are expected to consult.

a. Those circumstances include the following:

i. Application of newly issued technical pronouncements

ii. Industries with special accounting, auditing, or reporting requirements

iii. Emerging practice problems

iv. Choices among alternative generally accepted accounting principles upon initial adoption or when an accounting change is made

v. Reissuance of a report, consideration of omitted proce-dures after a report has been issued, or subsequent discov-ery of facts that existed at the time a report was issued

vi. Filing requirements of regulatory agencies

14. The firm has established criteria which require consultation with outside parties.

15. The firm requires the person ultimately responsible for the engage-ment to determine the need to consult.

a. That determination is based on the following:

i. The materiality of the matter

ii. The experience of senior engagement personnel in a par-ticular industry or functional area

iii. Whether generally accepted accounting principles or gen-erally accepted auditing standards in the functional area are as follows:

(a) Based on authoritative pronouncements that are sub-ject to varying interpretations

(b) Based on varied interpretations of prevailing practice

(c) Developed

(d) Under active consideration by an authoritative body

(e) Not previously interpreted by the firm (for example, in connection with another engagement)

16. The firm designates individuals within and outside the firm as con-sultants in certain areas.

17. The firm resolves differences of opinion between engagement per-sonnel and specialists before report issuance.

24



view year?

Yes No6

18. The firm maintains or provides its personnel access to adequate and current reference materials, including materials related to its clients.

a. Those materials include the most current versions of the fol-lowing:

i. AICPA Professional Standards

ii. AICPA A&A guides relevant to all industries in which the firm practices

iii. FASB pronouncements

iv. Any other pronouncements relevant to the firm’s practice (for example, SEC pronouncements, GASB pronounce-ments, Government Auditing Standards (the “Yellow Book”), and other government audit guides relevant to the firm’s practice)

19. The firm requires documentation of consultations.

a. That required documentation includes the following:

i. All relevant facts and circumstances

ii. References to professional literature used in the determina-tion

iii. Conclusions reached, and how they were implemented

iv. Signatures of engagement partner and consultant

v. Reference to the engagement working papers

The firm should establish criteria against which all engagements cov-ered by this section should be evaluated to determine whether an en-gagement quality control review should be performed. (QC sec. 10 par. .38)

20. The firm establishes criteria for determining whether an engage-ment quality control review is required to be performed prior to the release of the report. Those criteria are designed to be appropriate for the firm’s practice, are communicated to personnel, and reflect consideration of the nature of the firm’s practice, the nature of cer-tain engagements, unusual circumstances or risk, and whether laws or regulations require an engagement quality control review.

21. The criteria established by the firm require an engagement quality control review to be performed for the following:

a. An engagement for an entity operating in a highly specialized or regulated industry, including financial institutions, govern-mental entities and employee benefit plans

b. An engagement in an industry where the firm’s practice is lim-ited and the firm’s personnel have little or no experience

25



view year?

Yes No6

c. An engagement that represents over 10 percent of the firm’s A&A practice

The firm should establish policies and procedures setting out the na-ture, timing, and extent of an engagement quality control review. Such policies and procedures should require that the engagement quality control review be completed before the report is released. (QC sec. 10 par. .40)

22. When an engagement meets the criteria for an engagement quality control review,

a. The engagement partner should not select the engagement qual-ity control reviewer, when practicable.

b. The engagement quality control reviewer must have sufficient technical expertise, experience and objectivity. If the review-er’s objectivity becomes impaired, the reviewer must be re-placed.

c. The engagement quality control reviewer meets the independ-ence requirements relating to the engagements reviewed, even though the reviewer does not otherwise participate in the per-formance of the engagement during the period of review.

d. The engagement partner remains responsible for the engage-ment and its performance, and the engagement quality control reviewer does not make decisions for the engagement team.

e. The engagement partner may consult the engagement quality control reviewer at any stage during the engagement, with the understanding that the engagement quality control reviewer’s objectivity may be impaired if the nature and extent of consul-tations becomes significant.

f. The engagement quality control review may be conducted at various stages throughout the engagement.

g. The engagement quality control review includes a discussion with the engagement partner about significant findings and is-sues.

h. The engagement quality control review is completed before the report is released.

i. The engagement quality control review is documented. This in-cludes an assertion that the reviewer is not aware of any unre-solved matters that would cause the reviewer to believe that the significant judgments the engagement team made and the con-clusions it reached were not appropriate.

j. Before reports are released, matters that would cause the re-viewer to question the engagement team’s judgments and con-clusions are resolved.

26



view year?

Yes No6

The firm should establish policies and procedures for addressing and resolving differences of opinion within the engagement team; with those consulted; and, when applicable, between the engagement part-ner and the engagement quality control reviewer (QC sec. 10 par. .46)

23. The firm resolves differences of professional judgment within an engagement team. (See AU-C section 220, Quality Control for an Engagement Conducted in Accordance With Generally Accepted Au-diting Standards [AICPA, Professional Standards].)

a. In reaching resolutions, the firm

i. assigns responsibility for resolving such matters.

ii. allows assistants to document their disagreement with the conclusion reached and disassociate themselves from the resolution of the matter.

iii. requires conclusions reached to be appropriately docu-mented.

iv. requires that the matter be resolved before the report is released.

The firm should establish policies and procedures for engagement teams to complete the assembly of final engagement files on a timely basis after the engagement reports have been released. (QC sec. 10 par. .49)

24. The firm complies with professional standards, laws or regulation that prescribe time limits by which the assembly of final engagement files must be completed. When no such time limits are prescribed, the firm establishes time limits that reflect the need to complete the assembly of final engagement files on a timely basis.

The firm should establish policies and procedures designed to main-tain the confidentiality, safe custody, integrity, accessibility, and re-trievability of engagement documentation.(QC sec. 10 par. .50)

25. The firm must maintain confidentiality, safe custody, integrity, acces-sibility, and retrievability of engagement documentation.

The firm should establish policies and procedures for the retention of engagement documentation for a period sufficient to meet the needs of the firm, professional standards, laws, and regulations. (QC sec. 10 par. .51)

26. The firm retains engagement documentation for a period of time, sufficient to meet the needs of the firm, professional standards, and laws and regulations.

27


Objective

Determine whether the firm’s policies and procedures relative to engagement performance are being complied with to provide the firm with reasonable assurance of performing and reporting in conformity with applicable professional standards.

Procedures






Conclusion

Yes No

Are the firm’s policies and procedures relative to engagement performance designed and being complied with to provide the firm with reasonable assur-ance of performing and reporting in conformity with applicable professional standards?

28

Monitoring


Objective

Determine whether the firm’s policies and procedures relative to monitoring are relevant, adequate, and operating effectively.

Procedures





view year?

Yes No7

F. Monitoring

The firm should establish a monitoring process designed to provide it with reasonable assurance that the policies and procedures relating to the system of quality control are relevant, adequate, and operating ef-fectively. (QC sec. 10 par. .52)

1. The firm communicates its monitoring policies and procedures to firm personnel.

2. The firm performs ongoing consideration and evaluation of the sys-tem of quality control, including inspection or a period review of engagement documentation, reports, and clients’ financial state-ments for a selection of completed engagements.

a. At least annually, the firm

i. identifies new developments in professional standards and legal and regulatory requirements and how they are re-flected in the firm’s policies and procedures;

ii. interviews firm personnel and assesses their understanding of the firm’s quality control policies and procedures and implementation thereof;

iii. reviews selected administrative and personnel records per-taining to the quality control elements;

iv. reviews written confirmations of compliance with policies and procedures on independence;

v. evaluates training programs to determine whether they achieve their objectives;

vi. reviews summaries of CPE records to track each of its per-sonnel’s compliance with the requirements of the AICPA and other regulatory bodies;


29



view year?

Yes No7

vii. considers whether the firm’s professional development programs should be revised based on the results of the firm’s inspection or peer review;

viii. solicits information from firm personnel regarding effec-tiveness of the firm’s training programs;

ix. reviews engagement documentation, reports, and clients’ financial statements;

x. assesses the appropriateness of the firm’s guidance materi-als and any practice aids to assure they are updated for new professional pronouncements and are reliable and suitable for the firm’s practice;

xi. reviews decisions related to acceptance and continuance of client relationships and specific engagements;

xii. determines corrective actions to be taken and improve-ments to be made in the system, including providing feed-back into the firm’s policies and procedures relating to education and training;

xiii. communicates to appropriate firm personnel of weaknesses identified in the system, in the level of understanding of the system, or compliance with the system; and

xiv. follows up with appropriate firm personnel so that neces-sary modifications are promptly made to the quality con-trol policies and procedures.

b. Through the procedures performed, the firm evaluates

i. adherence to professional standards and applicable legal and regulatory requirements.

ii. whether the system of quality control has been appropri-ately designed and effectively implemented.

iii. whether the firm’s quality control policies and procedures have been operating effectively so that reports that are is-sued by the firm are appropriate in the circumstances.

3. The firm assigns responsibility for the firm’s process to a partner or partners or other persons with sufficient and appropriate experience and authority in the firm to assume that responsibility.

4. The firm establishes criteria to assure that individuals responsible for the inspection and other monitoring procedures have sufficient experience and authority to assume that responsibility.

a. The firm assures that those responsible for conducting monitor-ing procedures,

30



view year?

Yes No7

i. have sufficient training, experience and competence to execute their responsibilities;

ii. have no history of limitations or restrictions on their ability to practice public accounting; and

iii. have not acted as engagement partner on one or more ma-terially non-conforming engagements that were uncovered through peer review, monitoring, or regulatory inspection.

5. The firm performs timely inspections;8 post-issuance reviews of en-gagement working papers, reports, and clients’ financial statements for selected engagements; or both, to evaluate the firm’s compli-ance with its policies and procedures as part of its monitoring pro-cess.

In evaluating the firm’s compliance with its policies and proce-dures,

a. The firm assigns responsibility for performing the inspections or post-issuance reviews to a partner or manager-level individ-ual not associated with the engagement.

b. The firm’s inspections or post-issuance reviews include the fol-lowing:

i. Establishing an approach and timetable for performing the inspection or post-issuance review procedures and deter-mining the forms and checklists to be used and the extent of documentation required

ii. Performing appropriate tests of compliance with the firm’s policies and procedures on a sample basis

iii. Reviewing correspondence and documentation, as well as interviewing personnel, to determine the firm’s compliance with its policies and procedures regarding leadership respon-sibilities for quality within the firm, relevant ethical require-ments (including independence, integrity, and objectivity), acceptance and continuance of client relationships and specif-ic engagements, human resources, engagement performance, and monitoring

iv. Reviewing a cross section of engagements considering the following criteria:

(a) All partners and managers with significant accounting and auditing responsibilities

8 Paragraphs .A72–.A73 of QC section 10 provides guidance for inspection and monitoring procedures for small firms with a limited number of persons with sufficient and appropriate experience to effectively monitor compliance.

31



view year?

Yes No7

(b) The industries served by the firm, with at least one engagement selected from each specialized or regulat-ed industry (including financial institutions, govern-mental entities and employee benefit plans)

(c) The size of the firm, number and geographical loca-tion of offices, and the degree of authority

(d) Significant client engagements

(e) First-year engagements

(f) Level of service performed (that is, audit, review, compilation, and attestation engagements)

(g) Engagements for which there have been complaints or allegations from firm personnel, clients, or other third parties that the work performed by the firm failed to comply with professional standards, regulatory re-quirements, or the firm’s system of quality control

(h) Engagements in which there were significant disa-greements between the quality review partner and the engagement partner

v. Assuring the completeness of the engagement population upon which the inspection and peer review samples are based.

The firm should establish policies and procedures to address cases when the results of the monitoring procedures indicate that a report may be inappropriate or that procedures were omitted during the per-formance of the engagement. (QC sec. 10 par. .57)

6. If an engagement is found to be materially non-conforming after re-port issuance (for example, through firm monitoring, peer review or regulatory inspection), the firm assures that the requirements of pro-fessional standards to perform additional procedures and/or to con-sider recalling and reissuing the report were met and such considerations were documented.

The firm should communicate, at least annually, the results of the monitoring of its system of quality control to engagement partners and other appropriate individuals within the firm, including the firm’s leadership. (QC sec. 10 par. .58)

7. The firm summarizes and communicates at least annually to rele-vant engagement partners and other appropriate individuals with the firm, including the firm’s leadership, the monitoring process results, and any recommended changes to the firm’s policies and proce-dures.

32



view year?

Yes No7

8. The firm documents the evidence of the operation of each quality control system element (through its summary monitoring report, electronic databases, manual notes, checklists, and forms).

a. That documentation addresses

i. a description of the monitoring procedures performed to review and test compliance with firm quality control poli-cies and procedures relating to all of the elements of quali-ty control.

ii. review of the firm’s professional library and practice aids to determine that they were appropriate and up-to-date.

iii. interviews of a sample of personnel regarding the effec-tiveness of the firm’s professional development programs.

iv. the deficiencies identified through the monitoring proce-dures and an assessment of the significance of those defi-ciencies.

v. recommended corrective actions that are designed to pre-vent the recurrence of the deficiency. For each deficiency, one or more of the following must be recommended:

(a) Taking appropriate remedial action in relation to an individual engagement or member of personnel

(b) The communication of the findings to those responsi-ble for training and professional development

(c) Changes to the quality control policies and procedures

(d) Disciplinary action against those who fail to comply with the policies and procedures of the firm, especially those who do so repeatedly

9. The firm takes specific corrective actions or steps based upon the results of the monitoring process, and follows up on such planned corrective actions to assure compliance with its policies and proce-dures.

The firm should establish policies and procedures designed to provide it with reasonable assurance that it deals appropriately with com-plaints and allegations that the work performed by the firm fails to comply with professional standards and applicable legal and regulato-ry requirements and allegations of noncompliance with the firm’s sys-tem of quality control (QC sec. 10 par. .60)

10. The firm stresses the importance of obtaining feedback on its sys-tem of quality control from its personnel and actively pursues such feedback.

33



view year?

Yes No7

11. The managing partner informs personnel that they may raise any concerns about noncompliance with professional standards, regula-tory and legal requirements, or the firm’s system of quality control with any partner without fear of reprisals.

12. When complaints and allegations arise, the firm assigns a partner who is not otherwise involved in the engagement, or a suitably qualified external person or another firm, to investigate complaints and allegations and the responses to them. The firm documents the complaints and allegations and the responses to them.


Objective

Determine whether the firm’s policies and procedures relative to monitoring are relevant, adequate, and operating effectively.

Procedures






34

Conclusion

Yes No

Are the firm’s policies and procedures relative to monitoring designed and being complied with to provide the firm with reasonable assurance that they are relevant, adequate, and operating effectively?

35

APPENDIX A

Disposition of “No” Answers

Objective

Wherever a “no” answer was noted, determine whether the firm has implemented compensating controls which miti-gate the risk associated with the absence of or lack of compliance with the policy or procedure.

Procedures

1. Document all “no” answers from the checklist in the matrix below.

2. Determine, through discussion with the firm, whether any compensating controls exist which would mitigate the risk presented by the “no” answer.

3. Perform tests to confirm that the control was implemented and being complied with during the peer review year.

4. Conclude on whether the risk presented by the “no” answer was mitigated by compensating controls. If not, document on an MFC.

Nature of “No” Answer Disposition

Policy # Design Compliance Description of compensating controls (if any), including procedures per-

formed to evaluate design and com-pliance

Risk mitigated by compensat-

ing controls

MFC