Monitoring A Small Firm

How should small firms comply with the American Institute of CPAs practice-monitoring requirements? In many small firms, having limited personnel means an individual may have to review his or her own performance. Despite the problems that could result from such a situation, a combination of internal and external monitoring can achieve an acceptable solution.

In May 1996, the AICPA auditing standards board issued two statements on quality control standards that were effective January 1, 1997. SQCS no. 2, System of Quality Control for a CPA Firm’s Accounting and Auditing Practice , supersedes SQCS no. 1, System of Quality Control for a CPA Firm . SQCS no. 3, Monitoring a CPA Firm’s Accounting and Auditing Practice , changed the monitoring of compliance with quality control standards.

Monitoring, which replaces the old inspection element and is probably the biggest change in the new standards, includes the old inspection element but has a broader meaning. Previously, inspection was generally interpreted to mean annual inspections of the quality control system. The new monitoring element involves an ongoing consideration and evaluation of that system. SQCS no. 3 provides CPAs with specific guidance on monitoring procedures.

Neither the old nor the new standards require documentation of the quality control system; however, the new standards require (as did an interpretation of the old standard) documentation of the monitoring of compliance with the quality control system.

Broadly, firm monitoring now includes the ongoing consideration and evaluation of

• Management philosophy and the practice environment.
• The relevance and adequacy of policies and procedures.
• Compliance with policies and procedures.
• Appropriateness of guidance materials and practice aids.
• Effectiveness of professional development activities.
  SQCS no. 3 provides specific guidance on what monitoring procedures may include, such as
• An analysis and assessment of
  – The relevance of new professional pronouncements to the firm’s practice.
  – Continuing professional education and any other professional development activities.
  – Client and engagement acceptance and continuation decisions.
  – Independence confirmations.
  
• Interviews of firm personnel.
• Preissuance or postissuance review of engagements.
• Inspections.
  Based on the monitoring results, the firm should determine if it needs to take any corrective action or make improvements, communicate those findings to appropriate personnel and follow up on any modifications made to policies and procedures on a timely basis.
  

While monitoring procedures can, and in many firms probably will, be performed as part of an annual inspection, they don’t have to be. A firm could monitor its independence confirmations in January, its compliance with CPE requirements in June and its client and engagement acceptance every time a new client or engagement is accepted and review selected engagements in September. Whenever a firm performs monitoring procedures, it should document them.

MONITORING IN SMALL FIRMS
SQCS no. 3 says monitoring procedures in a small firm may be performed by the same individuals who are responsible for compliance with the quality control policies and procedures. That is, an individual can critically review his or her own performance. The statement recognizes the inherent problems of having an individual monitor his or her own compliance with the quality control system and encourages small firms to select qualified individuals outside the firm to monitor them, especially when changes have occurred in the firm, such as gaining new clients in an industry not previously served or rapid growth.

It might be practical to have the firm perform certain monitoring procedures itself (for example, a review of the results of independence confirmations or analysis and assessment of the effect of new professional pronouncements) and to have “outside” qualified individuals perform others (for example, postissuance review of selected engagements).

The new quality control standards give a small firm considerable flexibility in how and when it should monitor its quality control system. The following discussion illustrates how to perform monitoring procedures and provides some ideas as to the timing flexibility the new standards permit.

To meet the requirement to document the monitoring of a firm’s quality control system, a small firm should set up a quality control system monitoring file to record its performance of the monitoring procedures. Exhibit 1, below, is an example of a summary control checklist a firm could use as the control document in such a file.

THE IMPACT OF NEW PROFESSIONAL PRONOUNCEMENTS
A firm should make the analysis and assessment of the relevance of new professional pronouncements that can affect its practice, and consequently its quality control system, an ongoing activity. The Journal of Accountancy publishes many of the new pronouncements affecting small firms in its Official Releases column. Thus, a practitioner can review the new pronouncements monthly (or after tax season for the first three months of the year) and record that review on a checklist similar to the one shown in exhibit 2 . This analysis of new pronouncements also can be made annually or periodically using other sources. (The entries in exhibit 2 are for illustrative purposes only and do not necessarily represent the number or variety of pronouncements likely to be issued in a given period.)

Other pronouncements affecting a firm’s practice may not be included in the Journal . For example, if a practice does federal compliance audits, new federal laws or regulations could affect the firm’s practice. The firm should include those it deems relevant in the checklist. If a pronouncement is determined not relevant to a firm’s practice, nothing else needs to be done. However, if it is considered relevant, the practitioner should make sure appropriate staff know about the new pronouncement and revise the firm’s practice materials accordingly.

The practitioner should make some notation of what was done; for example, “Determined that the changes were included in the firm’s financial statement and disclosure checklists.” Or “Scheduled CPE class on this new SAS for July.” Regardless of how the analysis and assessment of the relevance of new professional pronouncements is done, it should be documented. The firm also needs to make such an analysis and assessment when it obtains a client in a new industry (such as a federal compliance audit) or when it provides new services to an existing client (such as audit or attestation services for a tax client). In such circumstances, the practitioner should review older professional pronouncements as well as new ones and document this review.

MONITORING CPE AND OTHER PROFESSIONAL DEVELOPMENT ACTIVITIES
Staff professional development activities can be monitored most efficiently when a practitioner prepares the annual reports for state licensing authorities. Notations can be made on the firm’s copy of the report or by a memo included in the file that notes compliance with requirements of the state board of accountancy, the AICPA, the General Accounting Office, the state CPA society, the private companies practice section of the AICPA division for CPA firms or any other CPE requirements relevant to the firm’s practice. When monitoring CPE, the new requirement in the quality control standards-that personnel should participate in industry-specific CPE-also should be documented.

INDEPENDENCE CONFIRMATIONS
When a firm obtains a new client or provides a new service to an existing client, it should determine the independence of the firm and its personnel, as required by professional standards. This is not usually documented specifically, so the easiest way to do so is by annual or periodic written independence representations from all firm personnel. (An example is shown in exhibit 3 .)

MONITORING ACCEPTANCE AND CONTINUATION DECISIONS
Acceptance of a new client normally is of critical importance to a small firm. Depending on the type of industry and the services to be provided, accepting a new client can affect nearly all aspects of a firm’s quality control system: Are the firm’s library and practice aids adequate? Do personnel have appropriate CPE? Does the firm need an outside consultant? The best time to document the acceptance desision is when a new audit or attestation client or engagement is signed, using a form such as the questionnaire in exhibit 4 .

INTERVIEWS OF FIRM PERSONNEL
Interviewing staff members as a monitoring procedure may not appear to be relevant to a very small firm; however, if a firm has even one employee, it probably is a good idea. A CPA practitioner may discover that his or her perception of a firm’s quality control system is somewhat different from that of other employees. A good quality control system is supposed to communicate policies and procedures to staff; an interview may uncover communication failures.

Staff interviews also can be used to help monitor the industry-specific CPE requirement and evaluate an employee’s professional development. A firm should do such monitoring at least annually and, as always, should document it. A questionnaire based on the AICPA peer review program Staff Interview Questionnaire would be an easy way to document this monitoring procedure.

ENGAGEMENT REVIEWS
Preissuance reviews by the person with final responsibility for the engagement do not qualify as a monitoring procedure, even in a small firm, but postissuance reviews by that person do qualify. If there are a limited number of qualified managers, the person with final responsibility for the engagement can perform the postissuance review. It still has to be comprehensive and documented and should be done well after the engagement is completed. That is, the preissuance review of an engagement should not be completed on March 1 and the postissuance review on March 5.

Even in the best of circumstances, it is very difficult for practitioners to review their own work. If a CPA misses something on the preissuance review, it is likely he or she will miss it on a postissuance review. It is always desirable to have another qualified practitioner review the work. Such an “independent” review of audit or attestation engagements is particularly important when a small firm takes on an engagement in a new industry or a new area where the firm has had little or no previous experience. If a small practitioner has a relationship or association with a qualified peer, cross-reviews of each other’s engagements would be a good way to overcome the problem of trying to review their own work.

INSPECTIONS
Any or all of the above monitoring procedures can be performed as part of an annual inspection. SQCS no. 3 provides a degree of flexibility about what the inspection procedures should cover and when they should be done. The larger a firm, the more likely it will need to perform an annual inspection, even if it carries out other monitoring procedures at different times.

REASONABLE ASSURANCE

According to the new standards, monitoring procedures as a whole should allow a firm to obtain reasonable assurance that its quality control system is effective. This article provides some examples of ways a small firm can apply the specific monitoring procedures included in SQCS no. 3. However a firm decides to monitor its practice, the monitoring should be documented and provide the firm with reasonable assurance that the policies and procedures established for the other quality control elements are suitably designed and effectively applied.