SQMS 1 Risk Assessment Process: From Quality Objectives to Quality Risks to Responses

The firm's risk assessment process is the component the other seven depend on. SQMS No. 1 paragraph 24 requires the firm to design and implement a process to establish quality objectives, identify and assess quality risks, and design and implement responses to those risks. A peer reviewer will start here, because every other part of the system should trace back to it. Our SQMS 1 overview lists the eight components. This article takes the risk assessment process step by step.

Step 1: Establish quality objectives

Paragraph 25 requires the firm to establish the quality objectives the standard specifies, plus any additional objectives it considers necessary. The specified objectives are in paragraphs 29 to 34, one set for each of these components:

The monitoring and remediation process has its own requirements in paragraphs 36 to 48 rather than quality objectives.

The standard says the objectives are comprehensive enough that it is unlikely the firm will find it necessary to add more (A44). A firm may break objectives into sub-objectives to sharpen its risk identification (A45). Do not spend a week inventing objectives. Spend it on the risks.

Step 2: Identify and assess quality risks

Paragraph 26 requires the firm to obtain an understanding of the conditions, events, circumstances, actions or inactions that may adversely affect achievement of the objectives. The standard names two areas.

The firm's nature and circumstances:

• complexity and operating characteristics;
• strategic and operational decisions, business processes and business model;
• characteristics and management style of leadership;
• resources, including those from service providers;
• law, regulation, professional standards and the firm's operating environment; and
• for a firm in a network, the nature and extent of network requirements and services.

The nature and circumstances of its engagements:

• the types of engagements performed and reports issued; and
• the types of entities served.

Not every risk is a quality risk. A quality risk is one with a reasonable possibility of occurring and, alone or combined with other risks, adversely affecting achievement of one or more objectives (A47). That definition filters the list. "Staff turnover" is a risk. "Turnover of the only staff members with governmental audit experience before the single audit season" is a quality risk, because it plausibly defeats the objective that engagement teams have the competence to perform the work.

How to assess

Paragraph 26b requires the firm to take into account how, and the degree to which, those conditions may affect the objectives. The application material gives the factors (A50):

• how the condition would affect achievement of the objective;
• how often it is expected to occur;
• how long before it has an effect, and whether the firm could respond in that time; and
• how long the effect would last.

The standard states that the assessment need not use formal ratings or scores, though firms may use them. A short written reason for why the risk matters is what the firm's responses must be "based on, and responsive to" (paragraph 27 and A51).

Examples from the standard

The application material (A48) gives illustrations that translate directly to small-firm facts:

• A smaller firm with a few engagement partners with shared authority may face quality risks that leadership's responsibilities and accountability for quality are not clearly defined, and that leadership behavior that does not promote quality goes unquestioned.
• A firm recently merged with another may find that the two firms' technological resources are incompatible and that engagement teams keep using intellectual resources from before the merger that no longer fit the new methodology.
• A firm whose financial goals depend heavily on services outside the standard's scope, such as tax or advisory, may face risks that resources are allocated in a way that prioritizes those services over engagements within the standard.

A related point is easy to miss. Responses can create new risks. The firm may implement a technological resource to address one risk, and the use of that resource may give rise to further quality risks (A49).

Step 3: Design and implement responses

Paragraph 27 requires responses that address the quality risks in a manner based on the reasons for each assessment. The responses must include the specified responses in paragraph 35, but those alone are not sufficient to achieve the objectives of the system.

The specified responses are:

• policies for identifying, evaluating and addressing threats to relevant ethical requirements, and for identifying, communicating, evaluating and reporting breaches;
• a documented confirmation of compliance with independence requirements, obtained at least annually from all personnel required to be independent;
• policies for receiving, investigating and resolving complaints and allegations about failures to perform work to professional standards or comply with firm policies;
• policies for information learned after acceptance or continuance that would have caused the firm to decline, and for situations where law or regulation obligates the firm to accept;
• policies on when and what to communicate externally about the system; and
• policies for engagement quality reviews, requiring a review for engagements where law or regulation requires one, and where the firm determines a review is an appropriate response to one or more quality risks (35f).

Responses can sit at the firm level, the engagement level, or both. The standard's example is consultation: the firm sets the policy and appoints the consultants, and the engagement team recognizes when a matter needs consultation, initiates it and implements the result (A52). The need for formally documented policies is greater in firms with many personnel or several locations (A53).

Step 4: Keep it current

Paragraph 28 requires policies to identify information indicating that additional objectives, risks or responses are needed because the firm or its engagements changed. A less complex firm may do this informally when the people running the process see changes in the normal course of work. A larger firm may need periodic reviews (A54). Results from monitoring, network or service provider information, complaints, external inspections and regulatory actions all feed this process (A42). Remedial actions for deficiencies may add or modify objectives, risks or responses (A55). See monitoring and remediation under SQMS 1.

The process is iterative, not linear. While identifying risks the firm may find a missing objective, and while designing responses may find an unidentified risk (A41).

A register a reviewer can follow

A scalable standard allows a small firm to keep the objectives, risks and responses in a single document (A40). Use one row per quality risk, with columns for:

1. component and objective reference (for example, 33a, personnel competence);
2. the condition giving rise to the risk;
3. the risk, stated as what could go wrong;
4. assessment: reasoning on frequency, effect and time to respond;
5. response, tagged firm-level or engagement-level, with the specified response reference where applicable;
6. owner;
7. how it is monitored and the last monitoring date; and
8. last review date and what changed.

Link technology decisions to the register. A firm adopting new audit software or AI tools should have a resource-related risk row and a response such as approval criteria, training and a data confidentiality review. See AI in auditing for small CPA firms.

Frequently asked questions

Can we adopt the AICPA's template as our risk assessment?

A template is a starting point. Paragraph 26 requires understanding of this firm's conditions and engagements, and responses based on the reasons for the firm's own assessments. Delete risks that do not apply and add the ones the template omits.

Do we need numerical risk ratings?

No. The standard states that the assessment need not comprise formal ratings or scores (A50).

How often must the risk assessment be updated?

The standard has no fixed interval. It requires policies that identify information indicating changes are needed and require the firm to act on it (paragraph 28).

Sources

• AICPA, Statement on Quality Management Standards No. 1, A Firm's System of Quality Management (June 2022), paragraphs 24 to 35 and application material A40 to A56

CORAA prepares ready-to-review audit files for US CPA firms from QuickBooks books; you review and sign. See /us.

AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error