Small firms buy audit software, hire outside reviewers, engage specialists, use component auditors and sometimes belong to a network or alliance. SQMS No. 1 addresses all of it with one principle stated twice: using someone else's resource does not move the firm's responsibility. Paragraph 12 and A110 say the firm remains responsible for its system of quality management when it uses a service provider, and paragraph 49 says the same for network requirements and network services.
This article covers the service provider objective in paragraph 33h and the network provisions in paragraphs 49 to 53. For the rest of the standard, see our SQMS 1 overview.
Service providers
The quality objective
Paragraph 33h requires the firm to establish the objective that human, technological or intellectual resources from service providers are appropriate for use in the firm's system and in performing engagements, taking into account the objectives for each resource type in paragraphs 33d to 33g. Those are engagement team competence and time, people assigned to system activities, technological resources and intellectual resources.
What counts as a service provider
The application material lists examples (A111):
- individuals engaged to perform the firm's monitoring activities or engagement quality reviews, or to provide technical consultation;
- a commercial IT application used to perform audit engagements;
- individuals performing procedures on the firm's engagements, such as component auditors from firms outside the firm's network or someone engaged to attend a physical inventory count at a remote location; and
- an auditor's external specialist used to help obtain audit evidence.
An electronic confirmation platform and an AI-enabled workpaper tool fit the same pattern as the commercial IT application. SAS No. 150 separately expands the guidance on confirmation intermediaries and the reliability of electronic confirmation responses. See SAS 150.
Identify the risks first
In identifying and assessing quality risks, the firm must understand conditions that may adversely affect the objectives, including those relating to resources provided by service providers (paragraph 26a(i)(4) and A112). The firm may consider the nature of the resources, how and how much they are used, and the general characteristics of the providers, such as the types of professional services firms used. Service provider resources therefore belong in the risk register, with the risk stated as what could go wrong. See the SQMS 1 risk assessment process.
Deciding whether the resource is appropriate
A113 lists matters the firm may consider. They convert into a short due diligence file:
- The objective and risk the resource addresses. For a methodology, a risk could be that the provider does not update it for changes in standards.
- Nature, scope and conditions of the service. For an IT application: how often updates are provided, limits on use and how the provider addresses confidentiality of data.
- How the resource is used. Extent of use across the firm and whether it is suitable for that purpose.
- Extent of customization.
- The firm's history with the provider.
- The provider's industry experience and reputation.
- Results of attestation engagements by independent third parties, such as assurance engagements on quality control materials or reports on service organization controls.
The firm may also have actions of its own to take so the resource works, such as communicating information to the provider or having supporting IT infrastructure and processes in place (A114).
Component auditors from outside the network
For these, the standard says it may not be necessary or practicable to understand how the firm updates its methodology. The firm can instead review regulatory inspection results, published audit quality information or the component auditor's reputation (A115). See group audits under SAS 149.
Technology on the engagement
SAS No. 146's application material states that firm policy may prohibit software the firm has not approved, or require steps before using an unapproved application, such as confirming the team's competence to use it, testing its operation and security, and adding specific documentation to the file (A66). That is the engagement-level side of the firm's service provider evaluation. See AI in auditing for small CPA firms.
Information, monitoring and remediation
Information must flow in both directions. Paragraph 34d(i) requires the firm to communicate information to service providers that enables them to fulfill their responsibilities relating to the resources they provide. Information from service providers is one of the sources the firm considers when designing monitoring (paragraph 38f and A159). If a deficiency's root cause lies in a service provider's resource, the firm may consider whether to keep using it or communicate the matter to the provider. The firm must address the effect on its own system and prevent recurrence. It is not ordinarily responsible for remediating the deficiency on the provider's behalf or investigating the cause inside the provider (A188).
Network requirements and network services
A network is an association of entities that includes one or more firms, as defined in the AICPA Code. The network provisions apply to a firm whose arrangement meets that definition.
Paragraph 49 distinguishes two things:
- Network requirements: requirements the network establishes for the firm's system, including requirements to implement or use resources or services designed or provided through the network. Examples (A192) include additional quality objectives or risks common to the network, common responses such as a methodology or IT application, and a requirement to be subject to the network's monitoring.
- Network services: resources the firm chooses to use, such as voluntary training, component auditors or specialists from within the network, or a service delivery center (A193).
The firm must understand both, and its own responsibilities for implementing them. It must not allow compliance with network requirements or use of network services to contravene SQMS No. 1.
Make them fit the firm
Under paragraph 50 the firm determines how network requirements or services are relevant to its system and how they are implemented, and evaluates whether they need to be adapted or supplemented. The standard's examples (A198) show the logic. If the network requires certain quality risks but gives no assessment, the firm assesses those risks itself. If the network requires certain responses, the firm determines which risks they address and tailors them, for instance adding matters of law or regulation to a methodology. A network requirement can also create a risk. A standardized client acceptance application, for example, may not address local law the firm must consider (A196).
Network monitoring
Paragraphs 51 and 52 govern network monitoring:
- When the network monitors the firm's system, the firm determines the effect on its own monitoring, determines its responsibilities and obtains the results in a timely manner.
- The firm understands the scope of network monitoring across network firms and how results will be communicated. At least annually, where applicable, it obtains information from the network about the overall results across network firms, communicates it to engagement teams and others as appropriate, and considers its effect on the firm's system.
- If the network does not provide it, the firm may discuss the matter with the network and determine the effect on its engagements (A203).
Deficiencies in network requirements
If the firm finds a deficiency in network requirements or services, it communicates the relevant information to the network and designs and implements its own remedial actions under paragraph 43 (paragraph 53). It may need supplementary action if the network has not remediated or its remedy will take time (A205).
Documentation
Paragraph 60 requires the firm to document the paragraph 59 matters as they relate to network requirements and services, and the paragraph 50b evaluation of whether they need adapting. For service providers, keep the evaluation, risk register entry, response and monitoring evidence together per provider.
Frequently asked questions
Does an outside engagement quality reviewer count as a service provider?
Yes. Individuals engaged to perform engagement quality reviews are an example in A111.
Is a software vendor's report on service organization controls required?
No. The standard lists the results of independent attestation engagements as one matter the firm may consider (A113). The firm decides what information it needs to conclude the resource is appropriate.
Sources
- AICPA, Statement on Quality Management Standards No. 1, A Firm's System of Quality Management (June 2022), paragraphs 12, 26, 33h, 34d, 38f, 49 to 53 and 60 and application material A110 to A115, A159, A188, A191 to A205
- AICPA, Statement on Auditing Standards No. 146 (June 2022), application material A66
- AICPA, "AICPA updates standards involving audit confirmations": https://www.aicpa-cima.com/news/article/aicpa-updates-standards-involving-audit-confirmations
CORAA prepares ready-to-review audit files for US CPA firms from QuickBooks books; you review and sign. See /us.
Part of CORAA University · Quality management and practice: related guides, calculators and templates.
AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error