Quality Management Failure in a Small Practice's File Review
Marlow & Finch is a four-partner practice. Its engagement quality review (EQR) policy requires an EQR for 'all audits of entities with revenue over £10m'. In the year to 31 March 2025 it signed 38 audit reports. Six were for entities with revenue over £10m; one of those, a charity with revenue of £14m, was reviewed by the signing partner's own team rather than an independent reviewer. The firm's monitoring review, performed in May 2025, selected five files; the reviewer was the partner who had prepared two of them. Two files had no documented assessment of risks of material misstatement, and one had an unsigned engagement letter. The firm's total audit fee income is £1.9m against £4.2m of total income. The practice manager says the monitoring was 'a box-ticking exercise' and that the EQR threshold is a matter of professional judgement.
1. Assess the firm's compliance with ISQM 1 and ISQM 2, identifying the specific deficiencies and their root causes.
Read the worked answer
Under ISQM 1 the firm must design, implement and operate a system of quality management, and under ISQM 2 it must apply EQR criteria based on the engagement's risk, not only a revenue threshold. The deficiencies are: first, the EQR policy uses a single revenue threshold and fails to identify engagements where EQR is required because of risk - a charity with £14m revenue and public interest characteristics should have been assessed on risk, and in any event an EQR performed by the signing partner's own team is not an EQR at all, because the reviewer must be objective and not part of the engagement team. Second, the monitoring review lacks objectivity: the reviewer had prepared two of the five files, which breaches the requirement that monitoring be performed by objective individuals. Third, the two files with no documented risk assessment indicate a failure in engagement performance, and the unsigned engagement letter is a failure to obtain agreement of terms before work begins. The root causes appear to be a compliance culture that treats quality management as administrative, a policy written to a single metric rather than to risk, and no independent review of the monitoring function. The firm should revise the EQR criteria to include risk-based indicators, appoint an independent reviewer, and introduce a documented root cause analysis for every monitoring finding.
2. Recommend the remedial actions the firm should take before its next inspection, and explain how the firm should evaluate whether the remedies are effective.
Read the worked answer
The firm should take the following steps. Governance: designate a partner with ultimate responsibility for the system of quality management and report monitoring results to all partners. Policy: rewrite the EQR criteria so that EQR is required for all audits of public interest entities, all audits where significant risk or judgement is identified, and all audits above the revenue threshold; require the EQR reviewer to be independent of the engagement team and to have the experience to challenge it. Monitoring: ensure monitoring is performed by someone with no involvement in the files selected, and rotate the reviewer. Engagement performance: introduce a mandatory risk assessment template that must be completed and reviewed before fieldwork begins, and a checklist confirming the engagement letter is signed before the file is opened. Remediation tracking: record each finding, the action, an owner and a deadline, and re-test a sample of files after six months to confirm the action has been embedded. Effectiveness is evaluated by whether the same findings recur in the follow-up review, whether the revised EQR policy is actually applied to every qualifying engagement, and whether the culture has changed - evidenced by partners raising quality issues voluntarily. The firm should also consider whether the deficiencies are reportable to its recognised supervisory body.