Is your audit quality at the level it needs to be?
Jul 1, 2025
Despite the updated ISQM 1 standard being fully implemented since 2023, audit monitoring suggests that some firms haven’t yet fully embedded the process. ICAEW is offering more insights to support firms.
ICAEW’s Audit Monitoring Report 2025 confirmed that with 401 audit monitoring reviews completed, 67% of 790 audits reviewed were good or generally acceptable, and only 10% required significant improvement. The monitoring process is an opportunity for ICAEW, as an improvement regulator, to look broadly at where firms might benefit from some additional support in their audit quality journey.
Nick Reynolds, ICAEW Professional Standards Head of Audit, said: "Although we see a lot of good audit work across our wide range of registered firms, we know that some continue to struggle due to a variety of factors including inability to attract and retain good audit staff. We’ll continue to support our firms to help them build and maintain high standards.”
With this in mind, ICAEW’s Quality Assurance Department is sharing additional insights from its audit monitoring activities in July through two, free, hour-long webinars. The first, on 3 July, focuses on smaller firms and less complex audits and the second, on 10 July, on larger firms and more complex audits. Most auditors should find valuable content in both, whether directly relevant to the activities of their firm or to a wider understanding of issues across UK audit practices.
Alongside offering insights into the potential root causes of audit quality issues, ICAEW’s audit monitoring report outlined six common weaknesses and potential existing support. They include risk assessment, fraud and error, estimates and judgements, experts and service organisations, and substantive analytical procedures and sampling. These areas will be covered in greater depth in the webinars.
Supporting smaller firms
Most smaller audit firms are micro entities experiencing the same range of challenges as any small owner-managed business, including the difficulty of recruiting and retaining the right levels of expertise.
Small audit firms play a significant role in providing access to audit services for many small corporates, local charities and co-operative and community benefit societies across the UK. Their continued presence and success in the audit market is very important. Moreover, some smaller firms are taking on more complex audits.
It’s vital that these firms maintain audit quality supported by appropriate quality management procedures to serve the public interest.
Under the International Standard on Quality Management (ISQM 1) firms have to undertake monitoring activities, which will include not only cold file reviews but also checking other aspects of what they do and how they do it. Then, firms must evaluate the results of those monitoring activities to identify deficiencies. This leads to evaluation of those deficiencies with the help of root cause analysis, planning remediation action and monitoring the effectiveness of that action. This shift to a more dynamic, circular process is a significant change and is taking some firms longer to embed.
To help smaller firms understand this process better, ICAEW will walk members through some case studies that consider the outcomes of audit monitoring visits and hopefully “demystify the process”.
Neil Lawrinson, ICAEW Reviewer within the Quality Assurance Department, says: “That’s going to be quite important, but we’ll also be taking the opportunity to signpost up-and-coming issues such as recent changes in audit regulations, CPD monitoring, and how we’re engaging with the Financial Reporting Council on the year-long campaign on small and medium-sized entity audits.”
Documentation and adaptation
The key message in the webinars will be that at a very basic level, ICAEW requires firms to document a thought process about how they understand an audited entity, informing their risk assessment, and then to plan procedures to respond to that risk and “make sure that appropriate documentation of what you’ve actually done makes its way onto an audit file,” says Lawrinson.
The webinars aim to further break down this process through practical tips and advice. ICAEW will draw out how firms might have to follow different processes for different entities that are similar in size.
For example, one entity might be a standalone UK business with non-complex systems and procedures and genuinely low risk. However, this could be quite different for a business with a similar turnover, but that is a subsidiary of a large overseas group.
With the second scenario there may be more complex systems and processes, which need to be understood and considered as part of a firm’s risk assessment process. To take a different example, some sectors will typically have more significant judgements and estimates than other sectors and no two entities within the same sector are identical.
“Firms need to think about whether each client is genuinely low risk even if it might appear on first glance to be a less complex audit. Even for relatively low risk entities, a firm needs to obtain sufficient appropriate audit evidence based on granular risk assessment by audit assertion,” says Lawrinson.
On whole firm aspects, the key message from ICAEW is that while the ISQM 1 standard should be tailorable based on the specifics for a firm and its portfolio, there are some absolute basics that a firm must do. Lawrinson confirms: “We’d expect at least an annual evaluation each year that is tailored and appropriate, but there should be some documented thought behind the conclusion, and there has to be a clear conclusion.”
Larger firm focus
For the second webinar focused on larger firms and complex audits, ICAEW will dig deeper into the challenges that auditors might face and what it expects of an audit.
There will be a more in-depth focus on how firms demonstrate understanding to inform their risk assessments and planned responses, and the level of professional scepticism that should be demonstrated through this process. This will cover complex IT systems, clarity of assertion risk assessments and responses commensurate with the risks, identification and consideration, and judgements and accounting estimates at an appropriately granular level.
On estimates and judgements, Lawrinson says: “We’re going to draw out how sector and client-specific understanding should inform the identification and consideration of estimates and judgements, in turn informing the risk assessment and response.”
ICAEW will also outline a case study that highlights continuing challenges on how audit firms use and rely on experts and service organisations for more complex audits, commonly linked to estimates. This case study will also illustrate one of the challenges in sampling application and there will be separate reminders on the use of substantive analytical review, which still has an important part to play when done well.
Very few larger audit firms have not at least attempted full implementation of ISQM 1, even if improvements in some areas are still required. The focus for this webinar will be on how larger firms identify and evaluate findings from monitoring activities to identify and assess deficiencies and then follow up on these.
“We will illustrate how root cause analysis to evaluate deficiencies can be iterative. We will also consider how timely and focussed monitoring of the effectiveness of resulting planned remediation activities can give firms confidence that they have an effective system of quality management,” says Lawrinson. “We will use a simple case study to illustrate possible alternative realities associated with the same initial finding. Root cause analysis is not easy and most firms are still on a journey with this. That’s where we see the biggest opportunity for firms to drive continuous improvement.”
[ICAEW Insights]
