The firm’s risk assessment process: quality objectives, quality risks and responses

• Establish the required and any additional quality objectives
• Identify and assess quality risks using the conditions in QM 10.26
• Design responses that address the reasons for each risk assessment
• Maintain the process when the firm or its engagements change

Three steps that drive everything

QM 10.24 requires a risk assessment process that does three things: establish quality objectives, identify and assess quality risks, and design and implement responses. The other components are where the objectives live; this component is the engine.

Quality objectives

The standard specifies quality objectives for six components: governance and leadership (QM 10.29), relevant ethical requirements (.30), acceptance and continuance (.31), engagement performance (.32), resources (.33) and information and communication (.34). The firm must establish all of them, plus any additional objectives it considers necessary (QM 10.25). Most firms adopt the specified objectives as written. Additional objectives are worth adding when the firm has a distinct risk area, for example a large employee benefit plan practice or heavy use of offshore staff.

Identifying and assessing quality risks

A quality risk is a risk that has a reasonable possibility of occurring and, individually or with other risks, adversely affecting one or more quality objectives (QM 10.17). Both conditions must be met; you are not required to list every conceivable risk.

To identify them, the firm obtains an understanding of conditions, events, circumstances, actions or inactions that may adversely affect the objectives (QM 10.26a), covering:

• the firm: its complexity and operating characteristics; strategic and operational decisions and business model; the characteristics and management style of leadership; resources, including those from service providers; law, regulation, professional standards and the environment; and network requirements, if any; and
• its engagements: the types of engagements and reports, and the types of entities served.

The firm then takes into account how, and the degree to which, those conditions may affect the objectives (QM 10.26b). That assessment, often recorded as likelihood and magnitude, is what drives the design of responses.

Designing responses

Responses are policies or procedures designed to address one or more quality risks (QM 10.17). They must be based on and responsive to the reasons for the risk assessments (QM 10.27). A risk assessed as higher because staff turnover is high needs a different response from one assessed higher because the firm entered a new industry. QM 10.35 lists specified responses every firm must have, such as annual independence confirmations and a complaints policy, but those alone are not enough (QM 10.27).

Keeping it current

QM 10.28 requires policies or procedures to identify information that indicates objectives, risks or responses need to change because the firm or its engagements changed. Triggers include a merger, a new service line, a new audit software platform, a partner departure, peer review findings or new standards. When triggered, the firm updates its objectives, reassesses risks or modifies responses.

A practical register

Most firms document the process in a register: each quality objective, the related quality risks with their assessed reasons, the responses and the monitoring activity that will test each response. That chain is what a peer reviewer reads. Use the objectives, risks and responses register and the risk assessment guide.

Common implementation problems

• Generic risks copied from a practice aid with no link to the firm's own conditions.
• Every risk rated "medium."
• Responses that do not say who does what and when, so they cannot be monitored.
• No trigger process, so the register goes stale after year one.

Whitfield & Chen CPAs: from condition to response