The resources component of SQMS 1 is paragraph 33. It asks the firm to set quality objectives for obtaining, developing, using, maintaining, allocating and assigning resources in a timely manner so the system of quality management can be designed, implemented and operated. Eight objectives sit under it: five on people (a to e), one on technology (f), one on intellectual resources (g), and one on service providers (h).
For a small firm, this component produces the most concrete documentation: who is competent to sign what, which software is approved, and which guides the firm treats as its authority. This post covers each objective and gives a register format. The service provider objective is covered in network requirements and service providers; the risk process that selects your responses is in quality objectives and the risk assessment process.
What counts as a resource?
A90 lists human resources, technological resources (for example, IT applications) and intellectual resources (for example, written policies or procedures, a methodology or guides). Financial resources matter too, but A90 says they are addressed through the governance and leadership objectives on financial and operational priorities. Paragraph 29e of that component requires resource needs, including financial resources, to be planned for, and resources obtained, allocated or assigned in a manner consistent with the firm's commitment to quality.
A91 adds that resources may be internal or obtained from the network, another network firm or a service provider.
How do you plan resource needs?
A63 recognizes that resource needs change and that it may not be practicable to anticipate them all. Planning may involve determining the resources currently required, forecasting future needs, and setting up a process for unanticipated needs. A62 says the individuals with ultimate or operational responsibility for the system are able to influence what resources are obtained and how they are allocated, including timing.
A small firm's version is a short annual plan, set before busy season: how many audits by type, which partners and staff cover them, what outside help is expected, and a standing procedure for a mid-season addition such as a new client or a staff departure.
Human resources: paragraph 33a to 33e
- 33a: Personnel are hired, developed and retained, and have the competence and capabilities to consistently perform quality engagements, including knowledge or experience relevant to the engagements the firm performs, or to carry out system activities.
- 33b: Personnel demonstrate commitment to quality, maintain competence for their roles, and are held accountable or recognized through timely evaluations, compensation, promotion and other incentives.
- 33c: When the firm lacks sufficient or appropriate personnel, individuals are obtained from external sources (network, another network firm, or a service provider).
- 33d: Engagement team members, including the engagement partner, with appropriate competence and capabilities and sufficient time are assigned to each engagement.
- 33e: Individuals with appropriate competence, capabilities and sufficient time are assigned to perform activities within the system of quality management.
A92 defines competence as the ability to perform a role, which goes beyond knowledge: it is the integration and application of technical competence, professional skills, and professional ethics, values and attitudes. A95 allows less formal evaluation and feedback in firms with fewer personnel, and A96 allows simple or informal incentives that are not monetary.
Two linkages matter. First, the engagement partner has a responsibility under SAS 146 to determine that sufficient and appropriate resources are assigned or made available in a timely manner (A98). Second, 33e extends the same competence-and-time test to the people running the system: the monitoring lead and the person doing engagement quality reviews need time budgeted, not only a title. For practical staffing and training ideas, see staff training plan.
Technological resources: paragraph 33f
The objective is that appropriate technological resources are obtained or developed, implemented, maintained and used to enable the system and the performance of engagements.
A103 limits the scope to three groups: technology used directly in designing, implementing or operating the system; technology used directly by engagement teams; and technology essential to enabling those two, such as the IT infrastructure and IT processes supporting an application. A104 gives the scaling example: in a less complex firm this may be a commercial application bought from a service provider, with simple supporting processes such as authorizing access and processing updates.
When obtaining or maintaining an application, A105 lists matters to consider: data inputs are complete and appropriate; data confidentiality is preserved; the application operates as designed; outputs achieve their intended purpose; the general IT controls supporting it are appropriate; the need for specialized skills and training; and the need for procedures setting out how it operates.
A106 allows a firm to prohibit the use of an application or feature until it has been determined to operate appropriately and been approved. Alternatively, the firm can require teams to determine an unapproved application is appropriate before using it on an engagement. This is the paragraph to point to for AI features in audit software; see AI in workpapers.
Intellectual resources: paragraph 33g
Intellectual resources are the information and materials the firm uses to operate the system and promote consistency: written policies and procedures, a methodology, industry or subject-matter guides, accounting guides, standardized documentation, and access to information sources (A107). The objective adds a condition: they must be consistent with professional standards and applicable legal and regulatory requirements.
That condition is where small firms are exposed. An audit program template built under the old standards that has not been updated is an intellectual resource that is no longer consistent with the standards. A113 gives the matching quality risk for a methodology from a service provider: the provider does not update it for changes in professional standards.
A109 lists policies the firm may set for using technological and intellectual resources: requiring certain applications or guides on engagements, specifying qualifications needed to use them, setting out the engagement partner's responsibilities, and describing how the resource should be used and where support is available.
A resource register a small firm can use
| Resource | Type (33 letter) | Owner | Quality risk | Response | Reviewed |
|---|---|---|---|---|---|
| Audit methodology and templates | Intellectual (g) | Quality partner | Templates not updated for new standards | Annual update against standards changes; version log | Date |
| Engagement software | Technological (f) | Operations lead | Access not removed for leavers; update breaks workpapers | Quarterly access review; test updates before busy season | Date |
| Independence tracking tool | Technological (f) | Quality partner | Incomplete data inputs | Annual confirmation reconciled to client list | Date |
| Reviewer capacity, single-audit work | Human (d) | Managing partner | Not enough qualified reviewers in peak weeks | Engagement assignment sign-off; outside reviewer arranged by January 15 | Date |
| Outside EQR provider | Service provider (h) | Quality partner | Provider not competent in the industry | Competence and independence evaluation before engagement | Date |
The register ties each resource to the objective, risk and response, which is the structure the documentation requirement in paragraph 59 expects. The monitoring process then tests whether the responses operated; see monitoring and remediation.
Frequently asked questions
Do we need a formal technology inventory?
The standard requires appropriate technological resources, not an inventory. A register of the applications that fall within A103 is the simplest way to show the firm identified them.
Is a commercial audit software package an intellectual or technological resource?
Both, in many cases. A108 notes that intellectual resources can be made available through technology, for example a methodology embedded in the application. Document it once and list both objectives.
Does outsourcing staff to another firm satisfy 33c?
Using individuals from a service provider is the mechanism 33c names. The firm remains responsible for its system (A110) and has to meet objective 33h on appropriateness of the resource.
Sources
- AICPA, Statement on Quality Management Standards No. 1, A Firm's System of Quality Management (QM Section 10), paragraphs 29e, 33, 59 and application material A62, A63, A90 to A98, A103 to A109, A110 to A113: https://www.aicpa-cima.com/resources/landing/aicpa-professional-standards
- AICPA, Statement on Auditing Standards No. 146, Quality Management for an Engagement Conducted in Accordance With Generally Accepted Auditing Standards (engagement partner responsibilities for resources): https://a-us.storyblok.com/f/1015104/x/32853782b6/aicpa-sas-146.pdf
CORAA prepares ready-to-review audit files for US CPA firms from client books; you review and sign. See /us.
Part of CORAA University · Quality management and practice: related guides, calculators and templates.
AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error