Quality management at the firm level: CSQM 1 and CSQM 2

Auditing and Assurance I followed one audit from acceptance to the auditor's report. This course steps back and then forward. It steps back to look at the firm that performs audits, because the quality of any single engagement depends on systems that sit above it: how the firm decides which clients to accept, how it trains and assigns people, which software and methodology it gives them, and how it finds and fixes its own failures. It then steps forward into the harder parts of practice that ACCT-331 only touched: audits of groups with many components, the IT environment and service organizations, integrated audits of internal control, estimates and going concern, the end of the audit, and the other engagements public accountants perform, from reviews and compilations to special-purpose reports and sustainability assurance.

The running example throughout the course is Tamarack Foods Group Ltd., a packaged-food producer headquartered in Calgary, Alberta and listed on the TSX. The group has four operating components: the parent's own manufacturing operations, a distribution subsidiary based in Lethbridge, a manufacturing subsidiary in Monterrey, Mexico, and a small snack-brand subsidiary, plus a 30 per cent interest in a cold-storage business accounted for by the equity method. Consolidated revenue for the year ending December 31, 2026 is 412 million dollars and pre-tax income is 28.0 million. The auditor is Hollis Ward LLP, a mid-sized firm with 14 partners and about 220 staff, which also serves the small private clients used later in the course. All of these organizations, people and figures are invented.

From quality control to quality management

For decades, audit firms followed quality control standards that listed elements a firm had to address, such as leadership, ethics, acceptance, human resources, engagement performance and monitoring. Inspection findings around the world showed that firms could comply with those elements on paper while still producing weak audits. In December 2020 the International Auditing and Assurance Standards Board (IAASB) replaced its quality control standard with a package of three quality management standards. The change is more than a new name. Instead of a fixed checklist, each firm must design a system tailored to its own circumstances: it sets quality objectives, identifies the risks that could stop it achieving them, designs responses to those risks, monitors whether the responses work, and remediates what it finds.

In Canada, the Auditing and Assurance Standards Board (AASB) adopted the package as Canadian Standard on Quality Management (CSQM) 1, Quality Management for Firms that Perform Audits or Reviews of Financial Statements, or Other Assurance or Related Services Engagements; CSQM 2, Engagement Quality Reviews; and a revised CAS 220 on quality management for an audit. Systems had to be designed and implemented by December 15, 2022, with the first evaluation of the system within a year of that date. As discussed later in the course, firms performing only compilation engagements under CSRS 4200 are also within the scope of CSQM 1, because a compilation is a related services engagement.

The components of a system of quality management

CSQM 1 organizes the system into eight components. They interact: a weakness in one, such as resources, often shows up as a failure in another, such as engagement performance. The table describes each component and gives an example of how Hollis Ward LLP addresses it.

Two features run through all the components. The first is scalability. A sole practitioner who performs only compilations and a firm that audits banks are both required to have a system, but the system of the sole practitioner can be very simple, because the quality risks are fewer and less severe. The second is accountability. The firm must assign ultimate responsibility for the system to its chief executive or managing partner, and operational responsibility for the system, for compliance with independence requirements and for the monitoring and remediation process to named individuals with the authority, time and experience to carry it out.

Quality objectives, risks and responses

The risk assessment process is the engine of the new approach. The standard prescribes the quality objectives for each component; the firm may add more. The firm then identifies quality risks: risks that have a reasonable possibility of occurring and, individually or with others, of adversely affecting the achievement of a quality objective. For each risk it designs and implements responses. Some responses are required by the standard for every firm, such as policies for complaints and allegations, and for communicating with those charged with governance of listed entities; the rest depend on the firm's own assessment.

Identifying quality risks requires an understanding of the conditions, events, circumstances, actions or inactions that could affect the objectives. At Hollis Ward the 2026 workshop considered the firm's growth in group audits with Mexican components, the retirement of two senior audit partners, a new cloud audit platform introduced during the year, staff turnover of 21 per cent, and the increased use of generative AI tools by staff. The table shows how three of the resulting risks were linked to responses.

Responses have to be designed with enough precision to address the risk, which is the same idea an auditor applies to a client's controls. A policy that says teams should supervise component auditors is not a response to the risk of unclear instructions; a required review of the instructions by a specialist, documented before they are sent, is. The firm must also keep the risk assessment current. A merger, a new service line, a new regulatory requirement or a cluster of inspection findings should trigger a reassessment, not wait for next year's workshop.

Resources, including technology and service providers

Firms increasingly depend on technological resources: audit platforms, data extraction and analytics tools, confirmation portals, and, more recently, tools that use machine learning and large language models to read contracts, summarize minutes or suggest risk assessments. The quality management standards treat these as resources that the firm must evaluate before use and monitor afterwards. The questions are the familiar ones. Is the tool designed to do what the firm uses it for? Has it been tested, and by whom? Who may use it, with what training? How are its outputs checked? Is client data protected? An analytics routine that flags unusual journal entries, for example, is only useful if the firm knows how it selects entries and has verified that it processes the full population.

Intellectual resources include the firm's audit methodology, guidance, templates and practice aids. Human resources include not only the firm's own people but also individuals from network firms, component auditors from other firms and external experts. When a firm relies on resources provided by a network or a service provider, it remains responsible for its own system. Hollis Ward belongs to an international association of independent firms that provides a shared methodology; the firm must understand how the association designs and monitors that methodology and adapt it where Canadian or US requirements differ.

Monitoring, root causes and remediation

Monitoring tells the firm whether its system is working. Activities include inspections of completed engagements, reviews of engagements in progress, reviews of whether policies are being followed, and the results of external inspections and practice reviews. The standards require the firm to cyclically inspect completed engagements for each engagement partner, on a cycle the firm determines. Monitoring produces findings; the firm then evaluates whether findings, individually or in combination, are deficiencies in the system and, if so, investigates their root causes.

Root cause analysis is where many firms struggle. Saying that a file was poorly documented describes a finding, not a cause. The cause might be that the team was assigned too late, that the methodology was unclear, that a reviewer lacked expertise, or that incentives rewarded speed. The program below summarizes Hollis Ward's internal inspection of 40 files in 2026 and groups the findings by area and by the root cause recorded by the inspection team.

# Firm-level monitoring: results of the firm's 2026 internal file inspections (invented data).
# Each finding records the engagement, the area and the root cause the firm identified.
from collections import Counter

files_inspected = 40
findings = [
    ("E03", "Estimates", "Insufficient challenge of management"),
    ("E07", "Estimates", "Insufficient challenge of management"),
    ("E07", "Revenue", "Time pressure near deadline"),
    ("E11", "Group audit", "Unclear direction to component auditor"),
    ("E15", "IT controls", "Specialist involved too late"),
    ("E19", "Estimates", "Insufficient challenge of management"),
    ("E22", "Group audit", "Unclear direction to component auditor"),
    ("E22", "Documentation", "Time pressure near deadline"),
    ("E28", "IT controls", "Specialist involved too late"),
    ("E31", "Revenue", "Training gap on new standard"),
    ("E36", "Estimates", "Time pressure near deadline"),
]
files_with_findings = {f[0] for f in findings}
rate = len(files_with_findings) / files_inspected
print(f"Files inspected: {files_inspected}   files with findings: {len(files_with_findings)}   rate: {rate:.1%}")
print("\nFindings by area:")
for area, n in Counter(f[1] for f in findings).most_common():
    print(f"  {area:<14}{n:>3}")
print("\nFindings by root cause:")
for cause, n in Counter(f[2] for f in findings).most_common():
    share = n / len(findings)
    print(f"  {cause:<42}{n:>3}  {share:6.1%}")
# A deficiency in the system exists when a cause recurs across engagements.
pervasive = [c for c, n in Counter(f[2] for f in findings).items()
             if len({f[0] for f in findings if f[2] == c}) >= 3]
print("\nRoot causes seen on three or more engagements:", "; ".join(sorted(pervasive)))

Files inspected: 40   files with findings: 9   rate: 22.5%

Findings by area:
  Estimates       4
  Revenue         2
  Group audit     2
  IT controls     2
  Documentation   1

Findings by root cause:
  Insufficient challenge of management        3   27.3%
  Time pressure near deadline                 3   27.3%
  Unclear direction to component auditor      2   18.2%
  Specialist involved too late                2   18.2%
  Training gap on new standard                1    9.1%

Root causes seen on three or more engagements: Insufficient challenge of management; Time pressure near deadline

Nine of the 40 files, 22.5 per cent, had at least one finding. The areas look scattered, but the causes are not: two causes, insufficient challenge of management and time pressure near reporting deadlines, each appear on three different engagements. That recurrence across engagements suggests deficiencies in the system rather than isolated lapses, and the responses need to work at the level of the system: for example, mandatory specialist involvement for complex estimates, earlier completion milestones and partner review of planning before fieldwork begins. A single finding about one component auditor might be remediated on that engagement alone; two findings with the same cause, unclear direction to component auditors, point to the group audit methodology and training.

At least annually, the individual with ultimate responsibility evaluates the system and concludes whether it provides reasonable assurance that its objectives are being achieved. The conclusion can be that the system provides reasonable assurance; that it does so except for matters that have a severe but not pervasive effect; or that it does not. Under CSQM 1 this conclusion is documented and communicated within the firm.

Canadian firms that audit reporting issuers must also participate in the Canadian Public Accountability Board's (CPAB) inspection program. CPAB inspects a sample of files at each participating firm and reports significant findings, which it defines as deficiencies that could result in a material misstatement going undetected. As of October 2026, CPAB's most recent annual public report showed significant findings in about 23 per cent of the 120 files it inspected in 2025, and from 2026 CPAB has published individual firm-level inspection results. Other engagements are subject to practice inspection by the provincial CPA body, such as CPA Alberta for Hollis Ward.

Engagement quality reviews

An engagement quality review is an objective evaluation, performed before the report is dated, of the significant judgments made by the engagement team and the conclusions reached. CSQM 2 deals with who performs the review and how. The firm must require an engagement quality review for audits of listed entities, for engagements where a law or regulation requires one, and for other engagements where the firm decides a review is an appropriate response to quality risks. Hollis Ward requires reviews for all listed entities, all public sector audits over a size threshold, and every engagement where a going concern paragraph or modified opinion is expected.

The reviewer must have the competence, capability, time and authority to perform the review, and must be objective. The standard includes a cooling-off period of two years before a former engagement partner may become the engagement quality reviewer on the same engagement, unless a stricter ethics rule applies. The reviewer reads and discusses the significant matters with the engagement team, reviews selected documentation, evaluates the basis for significant judgments, and considers whether the report is appropriate. The reviewer does not reperform the audit. The engagement partner cannot date the report until the reviewer notifies the partner that the review is complete.

For the Tamarack audit, the engagement quality reviewer will focus on group scoping and the work of the Mexican component auditor, the evaluation of goodwill impairment, the going concern analysis, and the key audit matters to be communicated in the auditor's report.

Quality at the engagement level

The firm's system supports each engagement, but the engagement partner remains responsible for managing and achieving quality on the engagement. Under the revised engagement-level standard, the partner must be sufficiently and appropriately involved throughout, must determine that the team has enough appropriate resources, and may rely on the firm's policies unless information suggests they are not working. If a team member identifies that the firm's audit software is miscalculating sample sizes, for example, the partner cannot simply rely on the tool; the issue must be raised through the firm's information and communication channels so the system can respond.

This two-way relationship is the core idea of quality management. Engagement teams consume the firm's resources and policies, and they generate the information the firm needs to judge whether those resources and policies work. The rest of this course returns to it often: group audit instructions, IT specialists, the use of service organization reports and the decision to accept a review rather than an audit all depend on firm-level policies as much as on individual judgment.