Information and communication in the quality system

• Apply the information and communication quality objectives in QM 10.34
• Design the information flows that feed monitoring and the annual evaluation
• Implement the specified responses on complaints and external communication
• Communicate with networks and service providers about their responsibilities

Why this is its own component

A quality system runs on information: who is independent of which client, which engagements had going concern issues, which partner is overloaded, what the inspection found. QM 10.34 makes the flow of that information a component with its own quality objectives.

The quality objectives

QM 10.34 requires the firm to establish objectives that:

a. the information system identifies, captures, processes and maintains relevant and reliable information that supports the system, from internal or external sources; b. the firm's culture recognizes and reinforces the responsibility of personnel to exchange information with the firm and with one another; c. relevant and reliable information is exchanged throughout the firm and with engagement teams, both from the firm to personnel (enough for them to carry out their responsibilities) and from personnel back to the firm; and d. relevant and reliable information is communicated to external parties, including the firm's network and service providers so they can fulfill their responsibilities, and externally when required by law, regulation or professional standards or to support external parties' understanding of the system.

What the information system looks like

For most firms the "information system" is a set of ordinary tools: the practice management system (engagement lists, budgets, assembly dates), the independence database, the CPE tracker, the complaints log, the consultation log, inspection results and the peer review file. The question is whether those tools capture what the risk assessment and monitoring processes need, and whether the data is reliable. A practice management system that does not record report release dates cannot support a response on timely file assembly.

Specified responses

QM 10.35 includes two responses tied to this component:

• Complaints and allegations (QM 10.35c). Policies or procedures for receiving, investigating and resolving complaints and allegations about failures to perform work under professional standards and legal and regulatory requirements, or noncompliance with the firm's policies. Channels should allow staff to raise concerns without fear of reprisal, which SAS 146 paragraph 14c also emphasizes at engagement level.
• External communication (QM 10.35e). Policies or procedures on when it is appropriate to communicate with external parties about the firm's system, and what information to provide, including the nature, timing, extent and form. Examples: a governmental client's request for the firm's latest peer review report, a transparency report, or responses to a client's audit committee questions about the firm's quality.

Engagement-level communication

Communication runs both ways. The firm communicates monitoring results and identified deficiencies to engagement teams (QM 10.48); engagement partners must obtain an understanding of that information and stay alert for information relevant to the firm's monitoring and remediation process (SAS 146, paragraph 39). A partner who sees a recurring problem with a practice aid should report it.

Common implementation problems

• A complaints policy no one has used and staff do not know about.
• Independence data scattered across spreadsheets with no reconciliation to the client list.
• No defined policy on providing the peer review report or responding to governance questions.
• Inspection results shared with partners only, not with the staff who prepare the work.

The policy manual outline has a section for these policies, and the planning communication letter example shows engagement-level communication with governance.

Ingram Holt CPAs: tracing one piece of information