Building a resilient system of quality management means looking beyond your internal audit team. Your technology, external specialists and service providers matter too.

When reviewing your firm's compliance with International Standard on Quality Management 1 (ISQM 1), it's easy to focus on your employees, their qualifications and their training.

But ISQM 1's resources component extends beyond the people on your payroll. It also covers the technology, intellectual resources and external providers your firm relies upon to deliver quality engagements.

That distinction matters, particularly for smaller audit practices that depend on external specialists or third-party systems.

In a recent webinar on ISQM 1 resources, Lungi Sepotokele explored how firms can identify resource-related quality risks, establish appropriate controls and document their approach.

Here are five practical areas worth reviewing.

1. ISQM 1 requires more than a quality management policy

ISQM 1 replaced ISQC 1, moving the emphasis from compliance checklists towards a proactive, risk-based system of quality management.

For audit firms, this means establishing quality objectives, identifying risks that could prevent those objectives being achieved, and implementing appropriate responses.

The system must also be monitored, evaluated and updated where deficiencies are identified.

The resources component plays an important role because it supports the operation of other elements of quality management.

For example, an audit firm may identify a need for additional independent review. That decision involves several connected considerations:

• Governance and leadership: Does the firm allocate sufficient resources to support audit quality?
• Human resources: Are appropriately competent reviewers available?
• External providers: Does the firm need to engage a third-party reviewer?
• Ethical requirements: How will the review address the identified independence or familiarity risk?
• Monitoring and remediation: How will the firm evaluate whether its response has worked?

The practical lesson is that resource decisions should not be considered in isolation.

2. Human resources include people outside your firm

Your firm's quality management system needs to consider whether individuals performing relevant activities have sufficient competence, capabilities and time.

That assessment starts with your employees but does not necessarily end there.

External specialists, reviewers and other individuals involved in engagement delivery can also affect audit quality.

For smaller practices, this is particularly relevant where specialist expertise is obtained externally rather than maintained in-house.

Consider an audit engagement requiring specialist valuation input. Before relying on an external expert, the firm should consider whether that individual has the appropriate knowledge and capabilities.

Similar questions arise when appointing external file reviewers.

Your policies should establish how the firm evaluates relevant individuals, assigns responsibilities and addresses concerns about competence or availability.

3. Component auditors need clear responsibilities and communication

Group audits introduce another important resource consideration: the use of component auditors.

These individuals may operate within the same network or belong to an entirely separate firm.

Either arrangement can create challenges around communication, competence and consistency.

During the webinar, Lungi highlighted the importance of group audit instructions and a shared understanding of responsibilities.

For example, two audit teams working in different jurisdictions may use different terminology when describing risks and controls.

Without clarification, those differences can affect how instructions are interpreted and work is performed.

Firms should therefore consider:

• How responsibilities are communicated between audit teams.
• Whether individuals assigned to the work have appropriate competence and capabilities.
• How differences in methodology or terminology are resolved.
• What happens when concerns arise about the quality or completion of component work.

Where concerns cannot be resolved, additional direction, supervision or review may be necessary.

4. AI and audit technology introduce their own quality risks

Technology can support audit efficiency, documentation, monitoring and staff development.

However, using technology does not remove the need for professional judgement.

One of the most important risks discussed during the webinar was undue reliance on automated outputs.

Consider an automated document-matching tool.

It may successfully match an invoice date or transaction value without determining whether the underlying document is appropriate audit evidence.

The auditor still needs to consider whether the information relates to the correct entity, whether the amount is reasonable and whether the evidence supports the relevant assertion.

The same principle applies to spreadsheets, automated calculations and artificial intelligence.

An output may appear correct without being reliable.

Establish an AI policy before introducing new tools

Lungi recommended that firms restrict the use of AI applications until they have assessed and approved them.

This is particularly important where applications could process confidential client information.

An appropriate assessment should consider:

• Whether the application is suitable for its intended purpose.
• How client information is stored, processed and protected.
• Whether employees understand the tool's limitations.
• What human review is required before relying on outputs.
• How access and permitted uses are controlled.

Training and documented policies also help establish consistent expectations.

A firm should not assume that an AI tool is suitable for audit work simply because it produces useful results.

For further discussion of technological resources, watch the CPDStore ISQM 1 webinar.

5. External service providers remain part of your quality management responsibilities

Many audit firms rely on external providers for technology, specialist expertise and engagement support.

ISQM 1 recognises that firms may obtain resources from service providers.

However, outsourcing an activity does not remove the need to consider the quality risks associated with that resource.

For technology providers, relevant considerations include software updates, access controls and protection of client information.

For providers supplying individuals, firms should consider competence, availability and continuity.

For example, if a service provider changes the individual assigned to an engagement, the firm may need to reassess whether the replacement has suitable capabilities.

Information gathering is particularly important.

If a provider cannot supply sufficient information for the firm to assess its suitability, alternative evidence or another provider may need to be considered.

What should your firm document under ISQM 1?

Having appropriate resources is only part of the process. Your firm also needs evidence of how resource-related quality risks are managed.

The webinar highlighted several important areas of documentation:

1. Individuals responsible for relevant quality management activities.
2. Quality objectives and identified resource-related risks.
3. Responses designed to address those risks.
4. Evidence of monitoring activities.
5. Evaluation of findings and identified deficiencies.
6. Remedial actions and communication of those actions.
7. The basis for conclusions reached during evaluation.

This documentation should reflect how your firm actually operates.

For smaller practices, the emphasis should be on a proportionate approach that addresses the firm's circumstances, rather than adopting procedures designed for a substantially larger organisation.

Regular staff training, appropriate external reviews and a clear understanding of client engagements can also support the effective operation of the system.

Frequently asked questions about ISQM 1 resources

What are the resources covered by ISQM 1?

ISQM 1 addresses human, technological and intellectual resources used in a firm's system of quality management and engagement performance. It also considers resources obtained from external service providers.

Human resources include relevant personnel and, depending on the circumstances, individuals outside the firm. Technological resources include applications and supporting infrastructure. Intellectual resources include methodologies, policies and guidance.

Firms should identify the resources they rely upon, assess associated quality risks and establish appropriate responses.

Does ISQM 1 apply to small audit firms and sole practitioners?

Yes. ISQM 1 is designed to accommodate firms of different sizes and circumstances.

A sole practitioner may operate a substantially different system from a large audit network, but still needs to address applicable quality management requirements.

The key is proportionality. A smaller firm should identify the quality risks relevant to its activities and establish appropriate responses.

Where the firm relies on external reviewers, specialists or technology providers, those arrangements should also be considered.

Can audit firms use artificial intelligence under ISQM 1?

ISQM 1 does not impose a blanket prohibition on AI use. However, firms need to assess quality risks associated with technological resources used in their quality management systems or engagements.

These may include inaccurate outputs, inappropriate reliance on automated results and risks to confidential information.

A practical approach is to assess applications before approving them, establish permitted uses, provide staff training and require appropriate human review.

Professional judgement remains necessary when evaluating evidence produced or processed using AI.

How should audit firms assess external service providers under ISQM 1?

Firms should consider the nature of the resource being obtained, the provider's suitability and any associated quality risks.

For external reviewers or specialists, this may involve assessing competence, capabilities and availability.

For technology providers, it may involve reviewing information security arrangements, software maintenance and access controls.

The firm should document how it obtained relevant information and addressed identified concerns.

Where sufficient information cannot be obtained, the firm may need to consider alternative resources or providers.

How often should an ISQM 1 system of quality management be evaluated?

ISQM 1 requires an evaluation of the system of quality management at least annually.

The evaluation considers whether the system provides reasonable assurance that its objectives are being achieved.

This is distinct from treating quality management as a once-a-year checklist. Monitoring activities, identification of deficiencies and remediation should operate as appropriate throughout the year.

Firms should retain evidence of their monitoring activities, evaluation findings, conclusions and responses to identified deficiencies.

What documentation is needed for the ISQM 1 resources component?

Documentation should demonstrate how the firm has identified relevant quality objectives and risks, established responses and monitored their operation.

For resources, this may include staff competence assessments, training records, technology policies, external provider evaluations and evidence of relevant reviews.

The level of documentation will depend on the firm's circumstances and the nature of its quality risks.

The important point is that the records support an understanding of how the system has been designed, implemented and operated.

Building a more resilient quality management system

The central message from the webinar is straightforward: resources under ISQM 1 are not limited to your employees or internal systems.

Your external reviewers, component auditors, technology applications and service providers can all affect engagement quality.

A useful starting point is to identify the resources your firm depends upon, consider the risks associated with each, and review whether existing controls remain appropriate.

That gives you a stronger basis for maintaining and evaluating your system of quality management.

Watch the webinar: ISQM 1 Resources: From Human Resources to AI – Building a Resilient Quality System

The contents of this article are meant as a guide only and are not a substitute for professional advice. The authors accept no responsibility for any action taken, or refrained from, as a result of the material contained in this document. Specific advice should be obtained before acting or refraining from acting, in connection with the matters dealt with in this article.