ISQM (UK) 1 requires every firm that carries out audits and other engagements under the FRC’s performance standards to design, implement and operate a risk based system of quality management. Since 15 December 2022 the firm has had to set quality objectives, identify the risks to them, design responses, monitor and fix deficiencies, and have the person with ultimate responsibility evaluate the whole system at least once a year. The standard scales to the size of the firm, but even a sole practitioner auditor needs a documented system and a clear annual conclusion.

Which firms does ISQM (UK) 1 apply to?

Paragraph 5 says the standard applies to all firms performing audits or reviews of financial statements, or other assurance or related services engagements. In the UK it applies to firms performing engagements under FRC performance standards, which are:

  • audits of financial statements under ISAs (UK);
  • reporting accountant work in connection with an investment circular;
  • reviews of interim financial information by the entity’s auditor under ISRE (UK) 2410;
  • engagements to provide assurance on client assets to the FCA; and
  • assurance engagements the FRC specifies as public interest assurance engagements under ISAE (UK) 3000.

“Firm” includes a sole practitioner, partnership or company of professional accountants. A practice whose only assurance work falls outside that list should check what its professional body requires. For most practices the trigger is simple: if the firm is a registered auditor, ISQM (UK) 1 applies to the firm as a whole, alongside the audit regulations and practice assurance requirements.

The standard replaced ISQC (UK) 1. It required systems to be designed and implemented by 15 December 2022, with the first annual evaluation within one year of that date.

What are the eight components?

Paragraph 6 lists the components a system of quality management must address:

  1. the firm’s risk assessment process;
  2. governance and leadership;
  3. relevant ethical requirements;
  4. acceptance and continuance of client relationships and specific engagements;
  5. engagement performance;
  6. resources;
  7. information and communication; and
  8. the monitoring and remediation process.

Paragraph 19-1 adds a UK requirement for sound administrative and accounting procedures, internal quality control mechanisms, effective risk assessment procedures and effective safeguards over information processing systems. Paragraph 10 makes the system scalable: a firm doing only reviews or compilations will need a less complex and formal system than one auditing listed entities.

Who must take responsibility?

Paragraph 20 requires the firm to assign ultimate responsibility and accountability for the system to its chief executive or managing partner (or equivalent), and to assign operational responsibility for the system, for compliance with independence requirements and for monitoring and remediation. Those people need the experience, authority and time to do the job (paragraph 21) and a direct line to the person with ultimate responsibility (paragraph 22). For audit firms, paragraph 21-1 requires at least one individual eligible for appointment as a statutory auditor to hold both the ultimate and the operational responsibility roles.

How does the risk assessment process work?

Paragraphs 23 to 27 set a three step loop:

  • Quality objectives. The standard prescribes objectives for each component, and the firm adds any others it needs. Examples include supervision and review of less experienced staff by more experienced staff (paragraph 31(b)), timely assembly of engagement documentation (paragraph 31(f)) and resources from service providers being appropriate for use (paragraph 32(h)).
  • Quality risks. A quality risk is one with a reasonable possibility of occurring and of adversely affecting an objective. The firm must understand its own circumstances, including its leadership, business model, resources and service providers, and the types of engagements and entities it takes on.
  • Responses. Policies and procedures designed to address each risk, based on the reasons for the risk assessment.

The firm must also have a way of spotting changes, such as a new type of client or a key person leaving, that call for new objectives, risks or responses. In its 2025 monitoring insights ICAEW said good practice was “very clear, tailored risks and responses specific to the firm”, and criticised firms that relied on methodology providers’ templates without adapting them, for example where the firm uses subcontracting or outsourcing. Firms that use freelancers should read subcontracting work to freelance accountants alongside this page.

Which responses are compulsory?

Paragraph 34 requires certain responses whatever the risk assessment says, including:

  • policies to identify and deal with threats to compliance with ethical requirements and breaches of them;
  • a documented confirmation of compliance with independence requirements, at least annually, from all personnel who must be independent;
  • policies for receiving, investigating and resolving complaints and allegations about poor work (see client complaints procedure);
  • policies for information discovered after acceptance that would have led the firm to decline; and
  • engagement quality reviews for audits of listed entities and public interest entities, public reporting engagements under the Standards for Investment Reporting, engagements where law, regulation or the client assets standard requires one, and any other engagement where the firm decides a review is the right response to a risk.

ISQM (UK) 2 governs the review itself. The reviewer must not be a member of the engagement team, and a former engagement partner must observe a cooling off period of two years, or longer if ethical requirements demand, before acting as reviewer on that engagement. Paragraph 34-1(c) adds a UK requirement to assess independence, threats and safeguards, resources and the key audit partner’s eligibility before accepting or continuing an audit.

How must the firm monitor and fix problems?

Monitoring must be designed around the quality risks and responses, the results of previous monitoring, complaints, external inspections and information from service providers (paragraph 37). Paragraph 38 requires inspection of completed engagements, selecting at least one completed engagement for each engagement partner on a cyclical basis the firm decides. Nobody may inspect an engagement they worked on or reviewed as engagement quality reviewer (paragraph 39), which in a very small firm usually means buying in an external reviewer.

Findings must be evaluated to decide whether a deficiency exists, its root cause investigated, its severity and pervasiveness assessed, and remedial actions designed in response to the root cause (paragraphs 40 to 42). The person responsible for monitoring must check that remediation was implemented and works. ICAEW’s reviewers have warned that cold file reviews are not the only source of findings: issues picked up by ethics or CPD compliance checks also need evaluating, and “stopping at identifying the root cause without planning remediation defeats the purpose”.

What does the annual evaluation involve?

Under paragraphs 53 and 54 the person with ultimate responsibility evaluates the system as at a point in time, at least annually, and must reach one of three conclusions:

  1. the system provides reasonable assurance that its objectives are being achieved;
  2. it does so except for deficiencies with a severe but not pervasive effect; or
  3. it does not provide reasonable assurance.

A conclusion of the second or third kind requires prompt action and communication to engagement teams and, where the firm’s policies require, to external parties. ICAEW has reported that some smaller and mid sized firms had not carried out the evaluation at all or had worded the conclusion unclearly, and says firms should neither tailor the prescribed wording nor “sit on the fence” between the options. Audit firms must also carry out an annual evaluation of the internal quality control system (paragraph 56-1).

What documentation and retention does the standard require?

Paragraph 58 requires documentation of who holds the responsibility roles, the quality objectives and risks, the responses, the monitoring evidence, deficiencies and root causes, remediation, and the basis for the annual conclusion. Audit firms have additional UK records under paragraph 58-1, including a record for each audit of the entity, the key audit partner and fees, records of written complaints and significant breaches, and an annual internal report on measures taken. Paragraph 60-1 requires audit documentation to be retained for at least six years from the date of the auditor’s report; see how long practices should keep client files.

What does this look like in a small firm, and where do firms go wrong?

Illustration only. A two partner firm audits 20 small companies. One partner, a responsible individual, takes ultimate responsibility; the other takes operational responsibility for independence and monitoring. The firm’s risk register identifies staff turnover, a new charity client and reliance on an outsourced IT provider as quality risks. Each year an external reviewer cold reviews at least one completed file per audit partner on the agreed cycle, the partners log findings from file reviews, CPD checks and complaints, carry out root cause analysis, and the managing partner signs a written annual conclusion that uses one of the three prescribed options.

Common failures are:

  • a bought in risk register never tailored to the firm;
  • no annual evaluation, or a conclusion worded in the firm’s own terms;
  • monitoring limited to cold file reviews, ignoring ethics, CPD and complaints data;
  • root cause analysis with no remediation plan or follow up test; and
  • engagement quality reviews being applied without considering whether any of the firm’s risks call for one.

Weaknesses in quality management can feed into regulatory action; see FRC enforcement.

Solar Protect runs fee protection schemes for accountancy and bookkeeping practices. See how our accountant schemes work or read fee protection schemes for accountants.

Sources

Reviewed by Christine Anderson, Broker, Solar Protect. Last reviewed 8 October 2026. Part of Accountapedia, the Solar Protect guide to UK tax and accounting. This page is general information, not personalised advice.