Rithy & Partners: monitoring findings, late EQR and a three-year retention policy

1. Unsupported going concern conclusions (8 of 24; 33%). This is a failure in the engagement performance component of the quality management system - review and supervision by the engagement partner were not effective, and the documentation does not support the conclusion reached. ISA 230 requires the file to show that the conclusion is supported by the evidence. A third of files failing one area points to a systemic, not individual, cause - very likely the inexperience of the seniors, combined with inadequate review.

2. EQR completed after the report was dated (5 files, including a listed client). ISQM 2 and ISA 220 require the engagement quality review to be completed on or before the date of the auditor's report. Completing it afterwards means the report was issued without the required safeguard. For a listed client this is a serious breach: the firm must consider whether those reports need to be re-dated, whether the opinion remains supportable, and whether there is a regulatory reporting obligation to the Accounting and Auditing Regulator.

3. Reviewer's eligibility. A former partner paid per review is not automatically ineligible, but the fee-per-review arrangement creates a self-interest threat to objectivity, and a three-year absence raises competence and currency-of-knowledge questions. ISQM 2 requires objective, competent, eligible reviewers with criteria set in firm policy. A partner from outside the engagement team, or a suitably qualified external reviewer engaged on a fixed fee, is preferable.

4. File assembly and retention. ISA 230 requires assembly within 60 days of the report date, not 90. Retention must be at least five years from the report date and may be longer under local requirements. Destroying files after three years breaches both.

5. Experience mix (11 of 15 seniors under twelve months). A human resources deficiency: the firm cannot demonstrate that engagement teams collectively have the competence and time to perform the work. This is a plausible root cause of finding 1.

6. Monitoring partner's conflict. The person responsible for monitoring also leads the firm's largest client. Objectivity of the monitoring function is compromised; the Code requires monitoring to be performed by objective personnel.

7. No root cause analysis or remediation. ISQM 1 requires the firm to investigate the root cause of deficiencies and to design and implement remedial actions with owners and deadlines. Recording the findings and doing nothing converts a correctable issue into a system failure.

Step 1 - root cause analysis, not blame. For each finding, ask why the control failed. Methods: structured interviews with the engagement teams involved, review of the affected files for common features (same partner, same office, same sector, same experience profile), and a check of whether the firm's methodology was understood. Preliminary hypothesis: the experience mix (11 of 15 seniors under one year) plus partner review capacity is the common cause behind the going concern failures. The EQR failures have a different cause - scheduling and a misunderstanding of what "completed" means.

Step 2 - remedial actions, each with an owner and a deadline

• Going concern: mandatory going concern template and second-partner review for any engagement with an identified going concern indicator; targeted training for all seniors and managers within 60 days; retrospective review of the 8 files before the next reporting season, and consideration of whether any opinion needs revisiting.
• EQR: block the report date in the workflow system until the EQR is electronically signed off; appoint two eligible reviewers with fixed annual retainers rather than per-review fees; brief the listed client's audit committee.
• Retention: amend the policy to 60-day assembly and a minimum five-year retention (longer if local rules require), and stop any destruction scheduled under the old policy.
• Resourcing: reduce the number of engagements accepted per senior, recruit two experienced managers, and require engagement partners to sign off a competence assessment at planning.
• Monitoring: separate the monitoring role from client-serving responsibilities at the largest client.
• Governance: present findings, root causes, actions, owners and deadlines to the firm's leadership; track completion quarterly.

Step 3 - systemic or isolated? Judge on breadth, cause and recurrence. Here, three different components fail (engagement performance, human resources, monitoring and remediation), the errors span multiple offices and more than one engagement partner, and the same finding type recurs across eight files. That is systemic. The firm should conclude that its system does not yet provide reasonable assurance of quality, and should re-evaluate its quality objectives and risks under ISQM 1 rather than treating the review as a one-off housekeeping exercise.