1. AICPA Governmental Audit Quality Center Member Conference Call on The New Standards on Quality Control and Practical Implementation Tips
May 14, 2009

2. Diane Edelstein, CPA & Ahava Goldman, CPA Presented by
Maher Duessel, CPAs
&
Ahava Goldman, CPA
AICPA

3. 4/19/2017 2:32 AM
What we will cover?
Provide an overview of the requirements of Statement on Quality Control Standards (SQCS) No. 7
Discuss the elements of a system of quality control;
Provide practical tips for implementing SQCS No. 7 in your governmental audit practices;
Brief you on the quality control requirements of Government Auditing Standards and how they relate to SQCS No. 7; and
Review the additional GAQC membership requirements relating to your system of quality control and tips for implementing them.
SQCS No. 7 3

4. Overview of Statement on Quality Control Standards (SQCS) No
Overview of Statement on Quality Control Standards (SQCS) No. 7, A Firm’s System of Quality Control (AICPA, Professional Standards, vol. 2, QC sec. 10)

5. SQCS No. 7 Issued October 2007 Supersedes all previous SQCSs
4/19/2017 2:32 AM
SQCS No. 7
Issued October 2007
Supersedes all previous SQCSs
Effective as of January 1, 2009
Compliance with PCAOB QC standards does not automatically mean compliance with SQCS 7.
SQCS No. 7 5

6. 4/19/2017 2:32 AM
SQCS No. 7
The firm must establish a system of quality control designed to provide it with reasonable assurance that:
The firm and its personnel comply with professional standards and applicable regulatory and legal requirements, and
Reports issued are appropriate in the circumstances
This has not changed from previous standards.
SQCS No. 7 6

7. SQCS No. 7 A system of quality control consists of:
4/19/2017 2:32 AM
SQCS No. 7
A system of quality control consists of:
Policies designed to achieve these objectives and
The procedures necessary to implement and monitor compliance with those policies.
SQCS No. 7 7

8. SQCS No. 7 Documentation and Communication
4/19/2017 2:32 AM
SQCS No. 7
Documentation and Communication
Required to document QC policies and procedures.
Extent based on firm characteristics
Required to communicate QC policies and procedures to personnel.
More effective if in writing, but not required to be.
NEW REQUIREMENT
TAILOR TO FIRM – NOT a burden
The nature, extent, and formality of a firm’s quality control policies and procedures will depend on various factors such as the firm’s size, the number and operating characteristics of its offices, the degree of authority allowed its personnel, the knowledge and experience of its personnel, and the nature and complexity of the firm’s practice. For example, a sole practitioner may document his or her system by filling out checklists and questionnaires, like those included in the AICPA Peer Review Manual. SUPPLEMENT WITH EXPLANATIONS – HOW DONE. How does a sole practitioner communicate? During the annual review of the documentation.
SQCS No. 7 8

9. Elements of a System of Quality Control

10. Required Elements of QC System
4/19/2017 2:32 AM
Required Elements of QC System
Leadership responsibilities for quality within the firm (the “tone at the top”)
Relevant ethical requirements
Acceptance and continuance of client relationships and specific engagements
Human resources
Engagement performance
Monitoring
the structure that the standard uses in discussing the elements. Each element has an objective, and the objective is to obtain reasonable assurance that the element is properly playing its role in the firm’s complying with professional standards and issuing reports that are appropriate in the circumstances. As you remember, that is the overarching requirement of SQCS No. 7, and we’ll discuss how each element contributes to that.
SQCS No. 7 10

11. Tone at the Top Objective Promote a quality-oriented internal culture
4/19/2017 2:32 AM
Tone at the Top
Objective
Promote a
quality-oriented
internal culture
Most important element
SQCS No. 7 11

12. Tone at the Top
Policies
Require the firm’s leadership to assume ultimate responsibility for the QC system.
Assign management responsibilities so that commercial considerations do not override the quality of work performed.

13. Tone at the Top Policies (Cont’d)
Assign operational responsibility to appropriate personnel (experience, ability, authority)
Address personnel performance evaluation, compensation and advancement to demonstrate the firm’s overarching commitment to quality.
Devote resources to developing, communicating, and supporting QC policies and procedures.

14. Relevant Ethical Requirements
4/19/2017 2:32 AM
Relevant Ethical Requirements
Objective
Reasonable assurance that the firm and its personnel comply with relevant ethical requirements.
Independence
Objectivity
Integrity
SQCS No. 7 14

15. Relevant Ethical Requirements
Policies
Require personnel to comply with relevant ethical requirements
Communicate independence requirements to personnel
Identify and evaluate threats
Withdraw from engagements if effective safeguards to reduce threats to independence acceptably cannot be applied
Not required to be independent for compilations but required to disclose lack of independence

16. Relevant Ethical Requirements
Policies (Cont’d)
Annually obtain written confirmation from all personnel required to be independent
Confirm independence of another firm who performs part of the engagement
Rotate personnel for audits or attest engagements where required by regulation

17. 4/19/2017 2:32 AM
Acceptance and Continuance of Client Relationships and Specific Engagements
Objective - Firm should undertake or continue relationships and engagements only where it:
Has considered the integrity of the client and the risks associated with providing professional services in the particular circumstances.
Is competent to perform the engagement and has the capabilities and resources to do so.
Can comply with legal and ethical requirements.
Has reached an understanding with the client regarding the services to be performed.
SQCS No. 7 17

18. Evaluate management’s integrity and consider risks of engagement
4/19/2017 2:32 AM
Acceptance and Continuance of Client Relationships and Specific Engagements
Policies
Evaluate management’s integrity and consider risks of engagement
Evaluate whether engagement can be performed with professional competence; undertake only those engagements firm has capabilities, resources and competence to perform; and periodically evaluate whether relationship should be continued
SQCS No. 7 18

19. Document how issues were resolved.
4/19/2017 2:32 AM
Acceptance and Continuance of Client Relationships and Specific Engagements
Policies (Cont’d)
Obtain an understanding with the client regarding the services to be performed, preferably in writing.
Establish procedures on withdrawal from an engagement or from both the engagement and the client relationship
Document how issues were resolved.
SQCS No. 7 19

20. Human Resources Objective
4/19/2017 2:32 AM
Human Resources
Objective
Reasonable assurance of sufficient personnel with the necessary capabilities, competence and commitment to ethical principles to perform the engagements and enable the firms to issue appropriate reports.
SQCS No. 7 20

21. Human Resources Policies and procedures should address:
4/19/2017 2:32 AM
Human Resources
Policies and procedures should address:
Recruitment and hiring, if applicable;
Determining capabilities and competencies;
Assigning personnel to engagements, if applicable;
Professional development; and
Performance evaluation, compensation and advancement.
If applicable – if have no staff not applicable
SQCS No. 7 21

22. Engagement Performance
4/19/2017 2:32 AM
Engagement Performance
Objectives
Engagements are consistently performed in accordance with professional standards and regulatory and legal requirements, and the firm or the engagement partner issues reports that are appropriate in the circumstances.
SQCS No. 7 22

23. Engagement Performance
Policies
Plan all engagements to meet professional, regulatory, and the firm’s requirements.
Perform work and issue reports and other communications that meet professional, regulatory, and the firm’s requirements.
Require that work performed by other team members be reviewed by qualified engagement team members, which may include the engagement partner, on a timely basis.

24. Engagement Performance
4/19/2017 2:32 AM
Engagement Performance
Detailed guidance on
Engagement performance (plan and execute)
Supervision responsibilities
Review responsibilities
Engagement documentation
Consultation policies and procedures
Resolution of differences of opinions, including a requirement that reports not be released until the differences of opinions are resolved.
Next two slides give more detail on first two.
SQCS No. 7 24

25. Planning Procedures Assign engagement team
Update client information and obtain engagement letter
Prepare planning document
Work programs tailored to engagement
Staffing requirements and need for specialized knowledge
Risk assessment – economic conditions and fraud considerations
Budget with sufficient time

26. Supervision Procedures
Tracking the progress of the engagement;
Considering the capabilities and competence of individual members of the engagement team, whether they have sufficient time to carry out their work, whether they understand their instructions, and whether the work is being carried out in accordance with the planned approach to the engagement;
Addressing significant issues arising during the engagement, considering their significance, and appropriately modifying the planned approach; and
Identifying matters for consultation or consideration by more-experienced engagement team members during the engagement.
Note apply to per diem personnel
Note that some of these procedures listed under supervision just as easily could be engagement performance – there really isn’t a distinction

27. Review Responsibilities Policies
Determined on the basis that qualified engagement team members, which may include the engagement partner, review work performed by other team members on a timely basis.
Again, no clear distinction between supervision and review. Qualified – usually means more experienced, but the ASB recognized that in some smaller firms, there may be equally experienced personnel who are capable of reviewing each other’s work.

28. Review Checklist
Has the work been performed in accordance with professional standards and regulatory and legal requirements?
Have significant findings and issues been raised for further consideration?
Have appropriate consultations taken place and have the resulting conclusions have been documented and implemented?
Is the nature, timing, and extent of work performed appropriate and without need for revision?
Does the work performed support the conclusions reached and is it appropriately documented?
Is the evidence obtained sufficient and appropriate to support the report?
Have the objectives of the engagement procedures been achieved?
SQCS provides guidance on what would be considered in a review of the engagement, and this guidance translates well into a review checklist. Note that ideally all questions can be answered with a “yes”. Any “no” would need to be investigated.
Equally important to the performance of the review is evidencing the review of documentation of the work performed and conclusions reached, the financial statements, and the report.

29. Engagement Documentation Policies
Require the engagement team to complete the assembly of final engagement files on a timely basis.
Establish procedures to maintain the confidentiality, safe custody, integrity, accessibility, and retrievability of engagement documentation.
Require the retention of engagement documentation for a period of time sufficient to meet the needs of the firm, professional standards, laws, and regulations.
Engagement documentation policies and procedures include establishing guidelines for the form and content of documentation of the work performed and conclusions reached, and requiring personnel to follow them. Such documentation includes standardized forms, checklists, and questionnaires used in the performance of engagements.

30. Consultation Policies
Consultation takes place when appropriate (for example, when dealing with complex, unusual, unfamiliar, difficult, or contentious issues)
Sufficient and appropriate resources are available to enable appropriate consultation to take place
All the relevant facts known to the engagement team are provided to those consulted
The nature, scope, and conclusions of such consultations are documented
The conclusions resulting from such consultations are implemented
SQCS requires that firms have policies in place to be sure consultation takes place when appropriate.
note For sole practitioners, consultation resources include current technical references – make sure your subscriptions are up-to-date – and the AICPA Technical Hotline.

31. Differences of Opinion - Policies
Within the engagement team, with those consulted, and between the engagement partner and engagement quality control reviewer
Conclusions reached are documented and implemented
The report is not released until the matter is resolved
The report is not released until the matter is resolved
Note that if members of the team disagree with the resolution, they may disassociate themselves from the resolution and document that a disagreement continues to exist

32. Engagement Quality Control Review (EQCR)
4/19/2017 2:32 AM
Engagement Quality Control Review (EQCR)
Establish criteria for determining whether an engagement quality control review should be performed,
Evaluate all engagements against the criteria
Perform an engagement quality control review for all engagements that meet the criteria, and complete the review before the report is released.
Establish procedures addressing the nature, timing, extent and documentation of the engagement quality control review.
Some examples of criteria that a firm could establish are as follows:
All high-risk engagements, as defined by the firm
Audits of financial institutions – ERISA example all or other
Engagements performed for significant clients
Engagements where unusual circumstances or unusual risks have been identified by the engagement partner or quality control partner.
Example of bad policy – no objective criteria
Recognize that firms are not required to have any engagements that meet the criteria for an engagement quality control review. It is perfectly acceptable to set criteria and then not undertake any engagements that would meet the criteria – to the extent practical. For example, a sole practitioner whose practice is solely engagements under SSARs, the criteria for an engagement quality control review may be an engagement that falls under SASs or SSAEs. What is required is to have criteria, and then to evaluate each engagement against the criteria.
SQCS No. 7 32

33. 4/19/2017 2:32 AM
EQCR - Procedures
An objective evaluation of the significant judgments made by the engagement team, and the conclusions reached in formulating the report.
Reading the financial statements or other subject matter information and the report, and consideration of whether the report is appropriate.
Review of selected engagement documentation relating to the significant judgments the engagement team made and the conclusions they reached
Discussion with the engagement partner regarding significant findings and issues.
Extent depends on the complexity of the engagement and the risk that the report might not be appropriate in the circumstances.
DIFFERENCE BETWEEN EQCR AND PARTNER REVIEW – depends on firm requirements for partner review.
If time:
The firm establishes criteria for the eligibility of engagement quality control reviewers. Such as the following:
Meets the independence requirements relating to the engagements reviewed, even though the engagement quality control reviewer is not a member of the engagement team
Does not make decisions for the engagement team or participate in the performance of the engagement except that the engagement partner may consult the engagement quality control reviewer at any stage during the engagement
SQCS No. 7 33

34. 4/19/2017 2:32 AM
Monitoring
Objective – reasonable assurance that QC policies and procedures are
Relevant
Adequate
Operating effectively
Complied with in practice
SQCS No. 7 34

35. Monitoring - Requirements
4/19/2017 2:32 AM
Monitoring - Requirements
Ongoing evaluation of appropriateness of design and operating effectiveness
Assign responsibility for the monitoring process to a partner.
Assign performance of the monitoring process to competent individuals.
Perform sufficiently comprehensive procedures.
SQCS No. 7 35

36. Monitoring Procedures
Review of selected administrative and personnel records pertaining to the quality control elements
Review of engagement working papers, reports, and clients' financial statements
Discussions with the firm's personnel
Summarization of the findings from the monitoring procedures, at least annually, and consideration of the systemic causes of findings that indicate that improvements are needed

37. Monitoring Procedures cont’d
Determination of any corrective actions to be taken or improvements to be made with respect to the specific engagements reviewed or the firm's quality control policies and procedures
Communication of the identified findings to appropriate firm management personnel
Consideration of findings by appropriate firm management personnel who should also determine that any actions necessary, including necessary modifications to the quality control system, are taken on a timely basis

38. Monitoring Procedures cont’d
Assessment of
The appropriateness of the firm’s guidance materials and any practice aids;
New developments in professional standards and regulatory and legal requirements and how they are reflected in the firm’s policies and procedures where appropriate;
Compliance with policies and procedures on independence;
The effectiveness of continuing professional development, including training;
Decisions related to acceptance and continuance of client relationships and specific engagements; and
Firm personnel’s understanding of the firm’s quality control policies and procedures and implementation thereof.

39. 4/19/2017 2:32 AM
Monitoring
Monitoring procedures may be accomplished through the performance of:
Engagement quality control review
Post-issuance review of engagement working papers, reports, and clients’ financial statements for selected engagements
Inspection procedures
SQCS No. 7 39

40. Monitoring Self-inspection Not prohibited
4/19/2017 2:32 AM
Monitoring
Self-inspection
Not prohibited
Higher risk that noncompliance with policies and procedures will not be detected
SQCS No. 7 40

41. Monitoring - Communication
4/19/2017 2:32 AM
Monitoring - Communication
To engagement partners and others:
Deficiencies noted as a result of the monitoring process
Recommendations for appropriate remedial action.
To all relevant personnel:
Monitoring results at least annually.
SQCS No. 7 41

42. 4/19/2017 2:32 AM
Monitoring
Procedures to deal appropriately with complaints and allegations
Clear channels for personnel to raise concerns without fear of reprisal
Documentation of complaints and responses
SQCS No. 7 42

43. Monitoring - Documentation
4/19/2017 2:32 AM
Monitoring - Documentation
Document evidence of the operation of each element of its system of quality control.
Form and content based on firm characteristics
Retain this documentation for a period of time sufficient to permit those performing monitoring procedures and peer review to evaluate the firm’s compliance.
Form and content based on firm characteristics – NOT a burden on the firm
* Examples in Practice Aid – eg personnel example from discussion
SQCS No. 7 43

44. 4/19/2017 2:32 AM
SQCS No. 7 - Practice Aid
AICPA Audit and Accounting Practice Aid Series:
Establishing and Maintaining a System of Quality Control for a CPA Firm’s Accounting and Auditing Practice
Available at
This is excellent and FREE!!!
SQCS No. 7 44

45. Practical Tips for Implementing SQCS No. 7

46. Tips for Implementing SQCS No. 7
Do you update your current Quality Control document or start over?
It is important to remember that your Quality Control Document is fluid
Improving your document is ongoing.
Keep prior versions with noted effective dates.
SQCS 7 has a specific order that we thought was important to maintain. Though there was very little substantive change for us we found it to hard to amend
We used PPc sample and adapted from there. AICPA has sample policy in their practice aid

47. Tips for Implementing SQCS No. 7
Areas we struggled with:
Engagement quality review criteria.
EQCR reviewer being independent to the engagement.
Acceptance and continuation of client relationship documentation.
Complaints and allegations.
Recognize that firms are not required to have any engagements that meet the criteria for an engagement quality control review.
Discuss our process
Acceptance is discussed ongoing as part of proposal process – continuation is discussed as part of team assignment/schedule - where do we document
Internal was easy and already in place – external – we discarded suggestion of using our website. Added info to our engagement letters 47

48. Additional Quality Control Requirements of Government Auditing Standards

49. Yellow Book QC Requirements
July 2007 Revisions to Yellow Book
Supersedes the Jan and 2003 revisions
Enhanced and clarified the requirements for an audit organization’s system of quality control by specifying the elements of quality that an organization’s policies and procedures collectively address
Added a requirement that external audit organizations make their most recent peer review report publicly available

50. Yellow Book QC Requirements
Paragraph 3.50 – 3.54 discuss QC Requirements
Requirements for system of quality control are consistent with the AICPA proposed statement on Quality Control Standards except that the GAGAS requirements state that reviews of the work and the report that are normally part of supervision are not monitoring controls when used alone

51. Yellow Book QC Requirements
Those audit organizations seeking to enter into a contract to perform a GAGAS audit or attestation engagement should provide the following to the party contracting for such services
The audit organization’s most recent peer review report and any letter of comment
Any subsequent peer review reports and letters of comment received during the period of the contract
Auditors who are using another audit organization’s work should request
The audit organization’s latest peer review report
Any letter of comment

52. Yellow Book QC Requirements
Must document & communicate
Policies must address:
Leadership Responsibilities
Independence, Legal & Ethical Requirements
Initiation, Acceptance and Continuance of Engagements
Human Resources
Engagement performance, documentation and reporting
Monitoring
Leadership responsibilities: Designate responsibility for quality of GAGAS audits and communication of policies and procedures related to quality
Independence, legal, and ethical requirements: Policies and procedures designed to provide reasonable assurance that the audit organization, and its personnel maintained independence, and comply with applicable legal and ethical requirements
Initiation, acceptance, and continuance: Policies and procedures designed to provide reasonable assurance that the audit organization will undertake audit engagements only if it can comply with professional standards and ethical principles and is acting within the legal mandate or authority of the audit organization
Human resources: Policies and procedures designed to provide reasonable assurance that it has personnel with capabilities and competence to perform its audits in accordance with professional standards and legal and regulatory requirements
Engagement performance, documentation and reporting: Policies and procedures designed to provide reasonable assurance that engagements are performed and reports are issued in accordance with professional standards and legal and regulatory requirements
Monitoring of quality: an ongoing, periodic assessment of work completed designed to provide reasonable assurance that the policies and procedures related to the system of quality control are suitably designed and operating effectively in practice

53. Yellow Book QC Requirements
Monitoring:
Purpose:
Ensure adherence to requirements
Ensure QC is appropriately designed
Ensure QC policies & procedures are operating effectively

54. Yellow Book QC Requirements
Monitoring:
Engagement Supervision Alone is not Monitoring
Audit organizations to analyze and summarize the results of monitoring procedures at least annually
Include identification of any systemic issues needing improvement
Include recommendations for corrective action
Should be performed by individuals that collectively have sufficient expertise and authority

55. Additional GAQC Membership Requirements Relating to your System of Quality Control

56. GAQC Membership Requirements
Policies & Procedures:
GAQC Policies to be Addressed in QC Document
Identify Designated Partner
Client Acceptance and Retention
Engagement Performance and Review
Training and Supervision
Internal Inspection
Peer Review

57. GAQC Membership Requirements
Policies & Procedures con’t:
Methods of documenting:
Revise the firm’s QC document to address the governmental audit practice to comply with applicable professional standards and Center membership requirements.
Prepare an addendum to the firm’s existing QC Document

58. GAQC Membership Requirements
Policies & Procedures con’t:
Communicate
Circulate the revised firm QC document
Establish training to inform audit staff of the firm’s QC policies and procedures
Circulate communication to audit staff regarding the firm’s QC policies and procedures
Link to QC document on the firm’s intranet

59. GAQC Membership Requirements
Annual Internal Inspections:
Required to establish annual internal inspection procedures that include a review of the firm's governmental audit practice (that is, all audits performed under Government Auditing Standards)
Reviewer should have current experience & knowledge of governmental auditing and accounting practices
Engagements inspected should be representative of the firm’s governmental audit practice (e.g., single audits, program-specific audits, HUD audits, etc.) and the firm locations those audits are performed in
Inspection results should be made available to peer reviewer

60. GAQC Membership Requirements
Annual Internal Inspections con’t:
Firm’s monitoring process should Include a review of the firm’s compliance with GAQC membership requirements
A peer review is not a substitute for monitoring procedures
However, consistent with AICPA quality control standards, the peer review may substitute for some or all of its inspection procedures for the period covered by the peer review.

61. GAQC Membership Requirements
Annual Internal Inspections con’t:
Developing an Governmental Audit Practice Self-Inspection Strategy
Begin with the inventory of your governmental audits audits (that is, all performed under Government Auditing Standards)
Consider:
When is the best time of year to conduct this review?
Who should perform the review?
How long will it take?
How are we going to communicate the results?
What about multi-office issues?
How it differs from concurring partner reviews?
Obtain AICPA peer review checklist or develop firm checklist

62. GAQC Membership Requirements
DAQP - Designating an audit partner to have firm-wide responsibility for the quality of the firm's governmental audit practice.  
Having all audit partners of the firm residing in the United States and eligible for AICPA membership be members of the AICPA.
Ensuring that the DAQP meets the yellow book CPE requirements, even if that partner would not otherwise be subject to those CPE requirements. 
DAQP must participate in an annual Center-sponsored Webcast on recent developments in governmental auditing.
Making publicly available information about the firm’s most recently accepted peer review as determined by the Executive Committee.
Having firm’s governmental audits selected as part of the firms peer review reviewed by a peer review team member who is employed by a Center member firm.

63. GAQC Membership Requirements
Use the Q&A document on GAQC membership requirements located at:
(Note: This document is being updated for SQCS 7 however, it currently contains very useful and relevant information about GAQC membership requirements.)

64. Questions ????? 4/19/2017 2:32 AM This is excellent and FREE!!!
SQCS No. 7 64