ISQM 1 and ISQM 2: The Competence Obligations Inside Audit Quality Management

Every firm that audits or reviews financial statements now has to operate a documented system of quality management, evaluate it formally at least once a year, and name an individual who carries personal accountability for the conclusion. Most commentary on the standard treats it as a documentation exercise. Read the requirements and it is substantially a competence standard: who is hired, whether they can do the work, whether they are given enough time, and whether anyone checks.

ISQM 1 replaced ISQC 1 and was accompanied by ISQM 2 on engagement quality reviews and a revised ISA 220. Firms were required to have their systems designed and implemented by 15 December 2022, with the first formal evaluation falling within one year of that date (ISQM 1, para. 13).

A risk-based system, not a checklist

The structural change is that ISQM 1 does not hand firms a list of policies to adopt. It requires the firm to set quality objectives, identify the quality risks that threaten them, and design responses. Two firms of different size and client base should therefore end up with different systems, and a small firm copying a large firm’s manual has misunderstood the standard.

Paragraph 6 sets out eight components of the system of quality management:

• The firm’s risk assessment process — identifying and evaluating risks to quality
• Governance and leadership — the leadership structure and firm culture that support quality
• Relevant ethical requirements, including independence
• Acceptance and continuance of client relationships and specific engagements
• Engagement performance — how engagements are carried out and supervised
• Resources — the people, technology, knowledge and external providers the firm uses
• Information and communication — gathering and sharing reliable information
• Monitoring and remediation — checking the system and fixing what it finds

The resources component is where the people requirements live

Paragraph 32 is the provision most relevant to anyone responsible for training and development in an audit firm, and it is worth reading closely because it does several distinct things.

It requires that personnel are hired, developed and retained and have the competence and capabilities to perform their roles (32(a)). It requires that personnel demonstrate a commitment to quality through their actions and behaviours, and that they develop and maintain the appropriate competence to perform their roles (32(b)). The same paragraph requires that personnel are held accountable or recognised through timely evaluations, compensation, promotion and other incentives.

Then two requirements about sufficiency that firms routinely fail on. Engagement teams must have appropriate competence and capabilities, including being given sufficient time (32(d)). And individuals performing quality management activities must likewise have appropriate competence and capabilities, including sufficient time, to perform those activities (32(e)).

That phrase — sufficient time — converts resourcing decisions into quality management obligations. A competent reviewer who is not given the hours is a deficiency in the system, not a scheduling inconvenience. Note also that ISQM 1 never uses the word “training”. The obligation is expressed as competence developed and maintained, which is a higher bar: a course attended does not evidence it.

The annual evaluation, and who signs it

Paragraph 53 requires that the individual or individuals assigned ultimate responsibility and accountability for the system of quality management evaluate the system on behalf of the firm, as of a point in time and at least annually. Paragraph 20(a) indicates this is ordinarily the firm’s chief executive or managing partner.

Paragraph 54 gives three possible conclusions, and the middle one is the one firms do not expect:

1. The system provides the firm with reasonable assurance that the objectives of the system are achieved.
2. It does so except for matters related to identified deficiencies that have a severe but not pervasive effect.
3. The system does not provide reasonable assurance.

A qualified conclusion is a real possibility that has to be reached honestly and documented. And paragraph 56 adds that the firm shall undertake periodic performance evaluations of the individuals assigned ultimate responsibility and accountability for the system — the person who signs the evaluation is themselves evaluated on it.

This is the same design as regulatory accountability in other regulated firms, where a named individual holds a statutory responsibility rather than a department holding a general one — the pattern behind the COLP and COFA roles in regulated law firms.

ISQM 2 and the engagement quality reviewer

ISQM 2 governs engagement quality reviews, and it is largely a standard about one person’s eligibility.

The reviewer cannot be a member of the engagement team. A former engagement partner must observe a two-year cooling-off period before acting as reviewer on that client. The reviewer may be internal or external to the firm, must have sufficient authority to challenge the engagement partner, and must be protected from intimidation — in a culture where their views are respected rather than pressured.

On competence, the reviewer needs an understanding of the legal and professional framework and of the firm’s own policies, appropriate knowledge of the client’s industry, experience of similar engagements, and an understanding of the responsibilities for performing and documenting the review itself.

A review is required for listed company audits, for engagements where law or regulation requires one, and wherever the firm determines a review is an appropriate response to its identified quality risks — high complexity or judgement, a material restatement of comparatives, a disagreement with a predecessor auditor, reporting involving significant judgement such as a listing prospectus, engagements in which the firm has no prior experience, or as a response to an identified ethical threat.

The reviewer evaluates the team’s significant judgements and whether the documentation supports them, whether professional scepticism was exercised, the independence determination, whether appropriate consultation occurred, and whether the engagement partner was sufficiently involved. Critically, the audit report cannot be dated until the reviewer has confirmed the review is complete.

ISA 220 (Revised) puts it on the engagement partner

The revised ISA 220 makes the engagement partner responsible for implementing the firm’s quality policies on the audit and deciding whether more are needed, for directing, supervising and reviewing the work, and for ensuring that sufficient and appropriate resources are available in a timely manner and adjusted as circumstances change.

On people specifically, the engagement partner must ensure the engagement team — along with any external experts and any internal auditors providing direct assistance — has the competence required for the roles assigned to them. That is a per-engagement competence determination, not an annual HR process.

Why this belongs with every other competence regime

The pattern in ISQM is now visible across regulated sectors, drafted independently each time. EU GMP Chapter 2 requires continuing training with its effectiveness periodically assessed. The FDA’s Quality Management System Regulation, effective February 2026, deleted its personnel rule and adopted ISO 13485 clause 6.2, which requires effectiveness checks proportionate to the risk of the work — set out in our guide to the QMSR and ISO 13485 competence requirements. MHRA data integrity guidance expects reviewers to have the knowledge and system access to review the audit trails they sign, covered in our data integrity guide. ISQM 1 asks whether personnel develop and maintain competence, and whether they were given sufficient time to use it.

In each case the evidence that satisfies the regulator is demonstrated capability, not a completion record. For audit firms that is a change in what the training function is for: it exists to produce and evidence competence that survives an inspection, which is a different job from delivering the annual CPD hours that regimes like the FCA’s 35-hour requirement set out.

The practical test

Can the firm produce its quality objectives, the quality risks identified against them, and the responses designed? Is there a documented annual evaluation with a stated conclusion from paragraph 54, signed by a named individual? Can it show that engagement teams and quality reviewers had sufficient time, not merely the right qualifications? Are competence determinations made per engagement, as ISA 220 (Revised) requires, or once a year? And is the two-year cooling-off period actually observed when a former engagement partner becomes a reviewer?

Firms accustomed to control frameworks will recognise the architecture — objectives, risks, responses, monitoring — which is the same logic as the COSO internal control framework, applied to the firm’s own quality rather than a client’s. The difference is that the regulator can ask to see the evaluation, and an enforcement record exists where quality falls short, as our coverage of FCA fines against audit firms illustrates.