ISA 220 (revised) deals primarily with the engagement partners' responsibilities in overseeing the quality of the assurance work.
It forms part of the suite of Quality Management Standards, dovetailing with PES 3 Quality Management for Firms that Perform Audits or Reviews of Financial Statements or Other Assurance or Related Services Engagements (aka ISQM 1) and PES 4 Engagement Quality Reviews (aka ISQM 2).
ISA 220 (revised) was effective from December 2022. Its emphasis may be summarised as:
- Proactive management of quality at the engagement level by emphasising the importance of professional scepticism.
- Enhancing the auditor’s documentation judgments.
- Reinforcing the need for robust communications between the engagement team and partner.
A criticism of the prior standard was that firm quality control manuals were simply to satisfy standard requirements and were not used in the actual engagement. This standard clarifies the role and responsibilities of the engagement partner; notably, their required involvement throughout the engagement and their responsibility for managing and achieving quality at the engagement level.
The objective of the standard is as follows:
The auditor is to manage quality at the engagement level to obtain reasonable assurance that quality is achieved such that:
(a) The auditor has fulfilled the auditor’s responsibilities, and has conducted the audit under professional standards and applicable legal and regulatory requirements; and
(b) The auditor’s report issued is appropriate in the circumstances.
What are the Engagement Partner's main responsibilities in the engagement?
The new standard makes the engagement partner’s responsibilities around leadership and project management (including assessing the engagement team’s competence and objectivity) more explicit.
The engagement partner needs to be adequately involved throughout the engagement to provide the engagement leadership required to achieve high-quality audits.
The diagram below illustrates how the engagement partner’s overall engagement is responsible for managing and achieving quality through sufficient and appropriate involvement. Their significant judgments made and the conclusions reached are appropriate given the nature and circumstances of the audit. This overall responsibility includes:
Fulfilling leadership responsibilities
This includes taking actions to create an environment for the engagement that emphasises the firm’s culture and the expected behaviour of engagement team members and assigning procedures, tasks or actions to other members of the engagement team.
Leadership must assign responsibilities to other engagement team members. The standard recognises that the engagement partner may assign procedures, tasks, or actions to other engagement team members to assist the engagement partner in complying with the requirements but must take overall responsibility for the engagement quality.
Supporting engagement performance
This includes taking responsibility for the nature, timing and extent of direction, supervision and review of the work performed.
New requirements require the engagement partner to review the financial statements and the auditor’s report before dating the auditor’s report and, prior to their issuance, to review formal written communications to management, those charged with governance, or regulatory authorities.
The engagement partner must review audit documentation relating to significant matters and other areas involving significant judgments. The partner should focus on complex or contentious matters identified during the engagement and the conclusions reached.
The engagement partner must take overall responsibility for managing and achieving quality, including whether their involvement has been sufficient and appropriate throughout the engagement. The nature and circumstances of the engagement are taken into account, especially with significant judgements and conclusions reached.
Relevant Ethical Requirements
The standard has strengthened relevant ethical requirements and the engagement partner’s role in dealing with relevant ethical requirements. Accordingly, in addition to enhancing the extant requirements, ISA 220 (revised) includes requirements regarding:
• Understanding of the relevant ethical requirements and whether other members of the engagement team are aware of those requirements and the firm’s related policies or procedures;
• Threats to compliance with relevant ethical requirements; and
• Determining whether relevant ethical requirements, including those related to independence, have been fulfilled.
The engagement partner is responsible for determining sufficient and appropriate resources assigned or made available on a timely basis. They are responsible for taking appropriate action when the firm provides insufficient or inappropriate resources in the engagement team’s audit engagement.
The standard includes new application material detailing:
- How human, technological, and intellectual resources may be used to support the performance of audit engagements.
- How project management skills can help manage the quality of the audit engagement and the appropriate actions if the engagement partner determines that the resources are insufficient or inappropriate.
Examples of engagement resources the engagement partner can use to determine whether to depend on the firm’s related policies or procedures include:
• Information systems that monitor independence;
• Information systems that deal with acceptance and continuance of client relationships and audit engagements; and
• Audit methodologies and related implementation tools and guidance.
Some firm-level responses to quality risks are not performed at the engagement level but are nevertheless relevant when complying with ISA’s requirements. For example, determining whether the engagement team members collectively have the appropriate competence and capabilities to perform the audit engagement. The engagement partner should look at the firm’s policies or procedures dealing with personnel recruitment and professional training.
When determining whether they may depend on the firm’s policies or procedures in complying with the requirements, the engagement partner should take into account:
• Their knowledge or understanding of or practical experience with the firm's policies or procedures.
• Information provided by the firm’s monitoring and remediation processes indicates what firm policies or procedures operate effectively. For example, the engagement partner may depend on the firm’s technological development and maintenance programs when using firm-approved technology to perform audit procedures based on the firm’s information.
Project management is a crucial part of the engagement, and the engagement partner should be actively involved or have a documented process outlining how it is delegated.
Some examples of how a firm may project manage:
• Increasing the engagement team’s ability to exercise professional scepticism through alleviating budget or time constraints that may otherwise impede the exercise of professional scepticism;
• Facilitating timely performance of audit work to more effectively manage time constraints at the end of the audit process when more complex or contentious matters may arise;
• Monitoring the progress of the audit against the audit plan, including the achievement of key milestones, which may assist the engagement team in being proactive in identifying the need for making timely adjustments to the audit plan and the assigned resources;
• Assisting the engagement partner in taking responsibility for the direction and supervision of engagement team members and the review of their work; or
• Coordinating arrangements with component auditors and auditor’s experts.
The relationship between ISA 220 (revised), PES 3 and PES 4
ISA 220 operates as part of the broader system of quality management established by PES 3. Under PES 3, the firm establishes quality objectives, identifies and assesses quality risks, and designs responses to address the quality risks concerning the components of the firm’s system of quality management. This can be achieved at the firm level or the engagement level, depending on its nature, circumstances, and engagement.
Accordingly, PES 3 requires the firm to communicate information to the engagement team about their responsibilities regarding the firm’s responses that require implementation at the engagement level.
ISA 220 and PES 3 align concerning monitoring and remediation. The engagement partner is responsible for dealing with the relevant aspects of the monitoring and remediation process. Communication by the firm includes the results of the monitoring and remediation process.
Furthermore, the engagement partner and team requirement to fully cooperate with the engagement quality reviewer is the linkage between ISA 220 and PES 4.
ISA 220 (revised) aims to implement a firm’s quality management system at the engagement level. In particular, the standard aims to ensure that the engagement partner is adequately involved throughout the engagement. To ensure that the team has adequate supervision (project management), expertise (in-house or external) and resources to satisfy the level of quality developed by the firm in their quality control manual.
The communication between the team members and the firm’s management and governance will help ensure that a firm’s quality management is fit for purpose and applicable to actual engagements.