In any profession, delivering quality of service is very important. The audit profession is quite different from others; wherein the audit report is used by not only the client but also other primary users of financial statements though they may not have even appointed them. The Standard of Quality Control for Firms that Perform Audits and Reviews of Historical Financial Information, and Other Assurance and Related Services Engagements’ (SQC) issued by ICAI deals with Engagement Quality Control Review.

Meaning of Engagement Quality Control Review

As per SQC, “It is a process designed to provide an objective evaluation, before the report is issued, of the significant judgments the engagement team made and the conclusions they reached in formulating the report.” The SQC of ICAI is broadly like the International Standards of Quality Control issued by IFAC.

Quality review is not mere review of the audit procedures of a particular engagement, but also includes ethical requirements, client acceptance procedures, human resource aspects, monitoring engagement amongst other things. Quality of service should be engrained in every activity and every sphere of profession and not restricted to a particular audit. As they say, auditor should not also be independent but also appear to be seen as independent. Similarly, the quality in the audit should also be demonstrated by way of proper documentation.

Who is eligible to do a Quality Review?

Per the definition in SQC, “a partner, other person in the firm, suitably qualified external person, or a team made up of such individuals, with sufficient and appropriate experience and authority to objectively evaluate, before the report is issued, the significant judgments the engagement team made and the conclusions they reached in formulating the report. However, in case the review is done by a team of individuals, such team should be headed by a member of the Institute.”

In a Firm, a Partner can be a Quality Review Partner or ‘Engagement Quality Control Reviewer’ (‘EQCR’ / ‘QRP’) who (Para 70, SQC 1) is selected as per the Quality Control policy of the firm and not associated with the engagement. Accordingly, the EQCR is being selected in accordance with the Quality Control policy of the firm. The firm should ensure that the ECQR has enough experience in accounting, audit and assurance and updated on latest developments in auditing sphere and has ability to independently assess the quality of the engagement at all stages.

In case of a sole proprietorship, they are free to use the services of another firm of CA or another CA for the purposes of quality control review of the engagement and to comply with SA 220 – Quality Control for an Audit of Financial Statements (Para 72 SQC 1).

Timing and Scope of EQRP

The scope of engagement includes all audits and reviews of historical financial information and for other assurance and related service engagements.

The timing of the quality review process is an important factor to be decided. As per SQC, “It is a process designed to provide an objective evaluation, before the report is issued, of the significant judgments the engagement team made and the conclusions they reached in formulating the report.” Hence, it is essential to ensure that the engagement’s quality review is planned and executed in a manner that the engagement partner would have time to consider the suggestions of EQRP in the audit and complete it accordingly. The EQCR is not a concurrent function rather is to be done only when the audit function is completed or nearly completion. In certain circumstances wherein the engagement partner is of the view that certain critical decisions need to be discussed, the EQCR can be done accordingly. The timing of the QRP would depend on complexity of the audit engagement considering the size of the client, regulatory environment, listed / unlisted entity, and other factors.

EQCR while reviewing the audit documentation needs to ensure that the audit has been carried out by considering the following aspects (Para 19, 20 and 21 of SA 220):

1. Engagement Planning

The EQRP should ensure that the engagement is:

• Well planned considering the timeline within the engagement is expected to be completed.
• Nature of Industry like banking, insurance, or other regulated industries may require the EQRP to ensure the specific factors are included in the audit planning stage.
• Ensuring engagement formalities are complied with.
• Risk assessment of the engagement and how the engagement has developed an audit program based on risks perceived and how the engagement team has evaluated the responsibilities relating to fraud.
• Review of the materiality and how the same has been re-examined over the engagement.
• The engagement team has been briefed about the engagement.

2. Engagement Execution

• Review of work papers to ensure sufficient and appropriate audit evidence has been documented.
• Review of significant judgements that are made especially relating to significant risks.
• Review of corrected and uncorrected misstatements and its possible impact on the financial statements and audit report.
• Adequacy of work papers to draw conclusion on the engagement.
• Engagement has been supervised by a senior / partner on a routine basis.

3. Engagement Reporting

• Review of the conclusions drawn by the engagement team and discussions with management on various issues.
• Review of the communication to those charged with governance.
• Discussions with the engagement team on critical audit observations and the judgements that the engagement partner has taken.
• Consultation on critical issues.
• Ensuring compliance with standards of auditing and other authoritative pronouncements of ICAI or any other authority.

It is up to the Engagement Partner, EQCR and the Firm’s SQC Policy to decide upon the timing of the review, documentation etc., but within the framework of SQC 1. For example: for an audit of a listed entity the EQCR must review the limited review activity done by the engagement team before the review report is released hence may have to be done on quarterly basis; but for an unlisted entity the timing could differ considering whether an interim audit is done or only a final audit is done. It is not expected of EQCR to do the activity concurrently or on real time basis; however, it is advisable for the engagement team to discuss with EQP at specific phase of audit or when some crucial issue needs to be discussed and opinion needs to be solicited.

Differences of Opinion (Para 57 of SQC 1)

It is always possible that during an audit engagement, the engagement partner and EQRP may have differences in terms of audit planning, execution, or conclusion. In such cases, the Firm is expected to have a policy on how the differences would be resolved, including but not limited to:

• Discussions with other senior partners in the Firm.
• Soliciting an opinion from another CA, not connected with the Firm.
• Consulting ICAI or any other regulatory or professional body.

Finally, the decision of the engagement partner shall prevail and if the decision is different from that of the EQCR; the same needs to be evidenced with adequate documentation.

Documentation of the EQCR and Engagement Documentation (Para 74 – Para 85, SQC 1)

The EQCR should ensure that audit documentation of the function of engagement quality control is:

• Done as per SQC and SA 230 and other applicable standards.
• The EQCR should have enough documentation to demonstrate that the EQCR has complied with all the entity level and engagement level functions including those related to resolution of differences.

Suggested Documentation of EQCR

Review Remarks from Quality Review Board of ICAI

The Quality Review Board in its review of audit engagements has observed that the audit firms have (Report on Audit Quality Review 2021-22):

• Not established policies and procedures requiring, an engagement quality control review procedures that provides an objective evaluation of the significant judgments made by the engagement team and the conclusions reached in formulating the report and setting out criteria against which all other audits and reviews of historical financial information, and other assurance and related services engagements should be evaluated to determine whether an engagement quality control review should be performed.
• Not establishing policies and procedures setting out: (a) the nature, timing, and extent of an engagement quality control review; (b) criteria for the eligibility of engagement quality control reviewers; and (c) documentation requirements for an engagement quality control review.

Review Remarks from National Financial Reporting Authority (NFRA)

In the following circumstances, the NFRA was of the view that it is not in line with SQC:

• EQC and Engagement Partner being the same.
• No documentation of review done by another CA who was nominated as quality review partner.
• The interim execution EQR Checklist and Audit Program EQR Checklist were signed on the same date indicating that, ‘as per the firm’s policy, the EQCR’s involvement is required in all stages of planning, execution and conclusion’.

Both the QRB and NFRA comments indicate that the EQCR process should be tightened and must be more robust at firm level. The whole quality of the audit would be compromised if the EQCR has not performed their duty diligently.

Suggested Contents of SQC Manual about EQCR

• Identifying EQCR and communication.
• Ensuring independence of EQCR and team.
• Policies and Procedures for dealing with and resolving difference of opinion within the engagement team, with an external consultant and between the engagement team and EQR Reviewer.
• Documentation of how the issues were resolved.
• Setting out the criteria what other engagements (other than audit of financial statements of listed entities) should be within the framework of EQR for example where the entity has significant public interest, regulated industry, entities having going concern issues or significant litigation etc.

Consequences of Not Having EQCR

The requirement of having EQCR stems from SQC 1. Para 1 of SQC 1 mentions that the provisions must be read in conjunction with the requirements of Chartered Accountants Act, 1949, the Code of Ethics and other relevant pronouncements of the Institute. In our view the Code of Ethics will equally apply to EQCR if they fail to detect and do not act on any non-compliances of standards of auditing, violation of Code of Ethics etc., by the engagement partner.

Under Section 132(2)(b) of the Companies Act 2013, requires NFRA to, inter-alia, monitor and enforce compliance with accounting standards and auditing standards in such manner as may be prescribed. Rule 8 of the NFRA Rules, 2018 provides that for the purpose of monitoring and enforcing compliance with auditing standards under the Act, NFRA may evaluate the sufficiency of the quality control system of the auditor and the manner of documentation of the system by the auditor and also perform such other testing of the audit, supervisory and quality control procedures of the auditor as may be considered necessary or appropriate (Source: AQRR of NFRA).

If there is a breach by the engagement partner, it is also the responsibility of the EQCR to point out the same and discuss with the leadership of the firm to resolve the issue. If the EQCR also chooses to remain silent even when the engagement partner violates say Code of Ethics, etc., in our view, the EQCR is also equally guilty.

Conclusion

With increased responsibilities on the audit fraternity including increase in expectations of the stakeholders from the auditor in terms of quality of reporting, discussing critical issues, regulatory checks and balances, complex business models which may require special accounting treatments etc., the role of EQCR only enhances. Where a firm has a large portfolio of clients it is imperative to have a robust, structured, and formal SQC Manual duly and the role of EQCR being monitored by the leadership of the Firm continuously. The requirement of EQCR also gives opportunity to other members in the profession to be considered as EQCR in firms who may need external consultants to comply with SQC norms. Hence, the role of EQCR cannot be undermined and is not a mere ‘fill the checklist’ activity but how actively they participate in ensuring the quality of engagement is delivered.

---

Authors may be reached at: adityahrudhayam@gmail.com and eboard@icai.in