Resources: people, technology, intellectual resources and service providers

In this lesson you will

Apply the human resources quality objectives in QM 10.33a-e
Evaluate technological and intellectual resources for appropriateness
Assess resources from service providers before using them
Identify quality risks arising from audit software and automated tools

The resources component

QM 10.33 requires quality objectives that address obtaining, developing, using, maintaining, allocating and assigning resources in a timely manner. It covers four kinds.

Human resources

Personnel are hired, developed and retained and have the competence and capabilities to perform quality engagements or carry out responsibilities in the system (QM 10.33a).
Personnel demonstrate a commitment to quality, maintain competence, and are held accountable or recognized through evaluations, compensation, promotion and other incentives (.33b).
Individuals are obtained from external sources (the network, a network firm or a service provider) when the firm lacks sufficient or appropriate personnel (.33c).
Engagement team members, including the engagement partner, with appropriate competence and capabilities, including sufficient time, are assigned to each engagement (.33d).
Individuals with appropriate competence, capabilities and time are assigned to activities within the system (.33e).

Typical responses: competency frameworks by level, CPE tracking by specialty (GAGAS, ERISA), staffing reviews before busy season and evaluations that include quality.

Technological resources

Appropriate technological resources are obtained or developed, implemented, maintained and used for the system and for engagements (QM 10.33f). This covers audit software, data analytics tools, practice management systems, document portals and, now, generative AI tools. Quality risks include:

a tool that produces wrong output (an analytics routine that drops records);
staff relying on output they cannot evaluate;
security and confidentiality weaknesses; and
tools used outside their intended purpose.

Responses include testing tools before rollout, restricting who can change templates, training, and policies on what may be entered into AI tools. See the guide on AI in workpapers.

Intellectual resources

Intellectual resources include the audit methodology, practice aids, templates, guidance and industry materials. They must be appropriate, maintained and consistent with professional standards and applicable legal and regulatory requirements (QM 10.33g). The classic failure is a methodology not updated for new standards: programs that still reference superseded AU-C sections, or a risk assessment form that predates SAS 145.

Service providers

A service provider is an individual or organization outside the firm (and outside its network) that provides a resource used in the system or on engagements (QM 10.17). Examples: an outsourced workpaper preparation team, a contract reviewer, a staffing agency, a software vendor, an external inspector, a CPE provider. Human, technological or intellectual resources from service providers must be appropriate for use, taking into account the objectives in .33d-g (QM 10.33h).

Even when the firm uses service providers, it remains responsible for its system (QM 10.12). Evaluating a provider includes its competence and reputation, its controls over confidentiality and data security, its compliance with relevant ethical requirements, and the firm's ability to supervise and review its work. The network and service providers guide and the outsourced prep peer review guide cover practical steps.

Common implementation problems

Audit software templates customized by staff with no change control.
Offshore service providers used with no evaluation of competence or confidentiality controls.
Practice aids two years out of date.
No time analysis behind staff assignments.

Worked example

Sorensen Vale CPAs: evaluating an offshore service provider

Sorensen Vale CPAs plans to use an offshore provider to prepare first-draft workpapers on 30 audits in 2026, about 4,500 hours.

Evaluation under QM 10.33h:

Area	Evidence obtained	Conclusion
Competence	Staff credentials, US GAAS training records, sample workpapers from a pilot on 2 audits	Adequate for cash, fixed assets and payroll; not for estimates or revenue
Confidentiality and security	SOC 2 type 2 report with no exceptions in the access control criteria; contract terms	Adequate
Ethics and independence	Contract requires compliance with the AICPA Code; annual independence confirmations from assigned staff	Adequate once confirmations collected
Client consent	Engagement letters updated to disclose third-party service providers	Required before use
Supervision and review	Firm in-charge reviews all provider workpapers	Requires 1 review hour per 4 provider hours

Review capacity: 4,500 / 4 = 1,125 review hours needed. The firm's in-charges have 900 available hours in peak months. Shortfall: 225 hours.

Decision: limit the provider to 3,600 hours (3,600 / 4 = 900 review hours) and restrict it to the three lower-risk areas. The evaluation, the limits and the monitoring plan (inspect 3 engagements that used the provider) are documented as responses.

Self-check

Answer each question before you open the answer.

Is a firm’s audit methodology a resource under SQMS No. 1?
Show answer
Yes. It is an intellectual resource, and QM 10.33g requires intellectual resources to be appropriate, maintained and consistent with professional standards.
Does using a service provider shift responsibility for quality to that provider?
Show answer
No. QM 10.12 states that the firm remains responsible for its system of quality management even when it uses resources from a service provider.
Give two quality risks from technological resources.
Show answer
Any two such as tools producing incorrect output, staff relying on output they cannot evaluate, confidentiality or security weaknesses, and uncontrolled changes to templates or tools.

Sources

Back to the syllabus

Standards are paraphrased from the primary sources listed above; read the source before relying on a requirement. This lesson is training material, not professional advice. Report an error