Personnel within the firm responsible for establishing and maintaining the firm’s system of quality control shall have an understanding of the entire text of this Standard, including its application and other explanatory material, to understand its objective and to apply its requirements properly.

The firm shall comply with each requirement of this Standard unless, in the circumstances of the firm, the requirement is not relevant to the services provided in respect of audits and reviews of financial reports, audits and reviews of other financial information, other assurance engagements and related services engagements.  (Ref: Para. A1‑Aus A1.1)

The requirements are designed to enable the firm to achieve the objective stated in this Standard.  The proper application of the requirements is therefore expected to provide a sufficient basis for the achievement of the objective.  However, because circumstances vary widely and all such circumstances cannot be anticipated, the firm shall consider whether there are particular matters or circumstances that require the firm to establish policies and procedures in addition to those required by this Standard to meet the stated objective.

The firm shall establish and maintain a system of quality control that includes policies and procedures that address each of the following elements:

1. Leadership responsibilities for quality within the firm.
2. Relevant ethical requirements. 
3. Acceptance and continuance of client relationships and specific engagements.
4. Human resources. 
5. Engagement performance.
6. Monitoring.

The firm shall document its policies and procedures and communicate them to the firm’s personnel.  (Ref: Para. A2‑A3)

The firm shall establish policies and procedures designed to promote an internal culture recognising that quality is essential in performing engagements.  Such policies and procedures shall require the firm’s chief executive officer (or equivalent) or, if appropriate, the firm’s managing board of partners (or equivalent) to assume ultimate responsibility for the firm’s system of quality control.  (Ref: Para. A4‑A5)

The firm shall establish policies and procedures such that any person or persons assigned operational responsibility for the firm’s system of quality control by the firm’s chief executive officer or managing board of partners has sufficient and appropriate experience and ability, and the necessary authority, to assume that responsibility.  (Ref: Para. A6)

The firm shall establish policies and procedures designed to provide it with reasonable assurance that the firm and its personnel comply with relevant ethical requirements.  (Ref: Para. A7‑A9)

Independence

The firm shall establish policies and procedures designed to provide it with reasonable assurance that the firm, its personnel and, where applicable, others subject to independence requirements (including network firm personnel) maintain independence where required by relevant ethical requirements, laws and regulations.  Such policies and procedures shall enable the firm to:  (Ref: Para. A10‑Aus A10.1) 

1. Communicate its independence requirements to its personnel and, where applicable, others subject to them; and
2. Identify threats to independence, evaluate whether the identified threats are at an acceptable level, and if not address them by eliminating the circumstances that create the threats, applying safeguards to reduce threats to an acceptable level, or withdrawing from the engagement, where withdrawal is possible under applicable law or regulation.

Where multiple threats to independence are identified, which individually might not be significant, the significance of those threats in aggregate and the safeguards applied or in place to eliminate some or all of the threats or reduce them to an acceptable level in aggregate, shall be evaluated.

Such policies and procedures shall require:  (Ref: Para. A10‑Aus A10.1)

1. Engagement partners to provide the firm with relevant information about client engagements, including the scope of services, to enable the firm to evaluate the overall impact, if any, on independence requirements;
2. Personnel to promptly notify the firm of circumstances and relationships that create threats to independence so that appropriate action can be taken; and
3. The accumulation and communication of relevant information to appropriate personnel so that:
   1. The firm and its personnel can readily determine whether they satisfy independence requirements;
   2. The firm can maintain and update its records relating to independence; and
   3. The firm can take appropriate action regarding identified threats to independence that are not at an acceptable level.

The firm shall establish policies and procedures designed to provide it with reasonable assurance that it is notified of breaches of independence requirements, and to enable it to take appropriate actions to resolve such situations.  The policies and procedures shall include requirements for: (Ref: Para. A10‑Aus A10.1)

1. Personnel to promptly notify the firm of independence breaches of which they become aware;
2. The firm to promptly communicate identified breaches of these policies and procedures to:
   1. The engagement partner who, with the firm, needs to address the breach; and
   2. Other relevant personnel in the firm and, where appropriate, the network, and those subject to the independence requirements who need to take appropriate action; and
3. Prompt communication to the firm, if necessary, by the engagement partner and the other individuals referred to in subparagraph 23(b)(ii) of this Standard, of the actions taken to resolve the matter, so that the firm can determine whether it should take further action.

[Deleted by the AUASB.  Refer Aus 24.1]

At least annually, the firm shall obtain written confirmation of compliance with its policies and procedures on independence from all firm personnel required to be independent by relevant ethical requirements, and applicable legal and regulatory requirements.  (Ref: Para. A10‑A11)

The firm shall establish policies and procedures: (Ref: Para. A10‑Aus A10.1)

1. Setting out criteria for determining the need to eliminate the circumstances that create a threat of long association with an entity to an acceptable level when using the same senior personnel on an assurance engagement over a long period of time or criteria for applying safeguards to reduce the threat; and
2. Requiring, for audits of financial reports of listed entities, the rotation of the engagement partner and the individuals responsible for engagement quality control review, and where applicable, others subject to rotation requirements, after a specified period in compliance with relevant ethical requirements. (Ref: Para. A12‑A17)

The firm shall establish policies and procedures for the acceptance and continuance of client relationships and specific engagements, designed to provide the firm with reasonable assurance that it will only undertake or continue relationships and engagements where the firm: 

1. Is competent to perform the engagement and has the capabilities, including time and resources, to do so;  (Ref: Para. A18, A23)
2. Can comply with relevant ethical requirements; and
3. Has considered the integrity of the client, and does not have information that would lead it to conclude that the client lacks integrity.  (Ref: Para. A19‑A20, A23)

Such policies and procedures shall require:

1. The firm to obtain such information as it considers necessary in the circumstances before accepting an engagement with a new client, when deciding whether to continue an existing engagement, and when considering acceptance of a new engagement with an existing client.  (Ref: Para. A21, A23)
2. If a potential conflict of interest is identified in accepting an engagement from a new or an existing client, the firm to determine whether it is appropriate to accept the engagement.
3. If issues have been identified, and the firm decides to accept or continue the client relationship or a specific engagement, the firm to document how the issues were resolved.

The firm shall establish policies and procedures on continuing an engagement and the client relationship, addressing the circumstances where the firm obtains information that would have caused it to decline the engagement had that information been available earlier.  Such policies and procedures shall include consideration of:

1. The professional and legal responsibilities that apply to the circumstances, including whether there is a requirement for the firm to report to the person or persons who made the appointment or, in some cases, to regulatory authorities; and
2. The possibility of withdrawing from the engagement or from both the engagement and the client relationship.  (Ref: Para. A22‑A23)

The firm shall establish policies and procedures designed to provide it with reasonable assurance that it has sufficient personnel with the competence, capabilities, and commitment to ethical principles necessary to:

1. Perform engagements in accordance with AUASB Standards, relevant ethical requirements, and applicable legal and regulatory requirements; and
2. Enable the firm or engagement partners to issue reports that are appropriate in the circumstances.  (Ref: Para. A24‑A29)

Assignment of Engagement Teams

The firm shall assign responsibility for each engagement to an engagement partner and shall establish policies and procedures requiring that:

1. The identity and role of the engagement partner are communicated to key members of client management and those charged with governance;
2. The engagement partner has the appropriate competence, capabilities, and authority to perform the role; and
3. The responsibilities of the engagement partner are clearly defined and communicated to that partner.  (Ref: Para. A30)

The firm shall also establish policies and procedures to assign appropriate personnel with the necessary competence, and capabilities to:

1. Perform engagements in accordance with AUASB Standards, relevant ethical requirements, and applicable legal and regulatory requirements; and
2. Enable the firm or engagement partners to issue reports that are appropriate in the circumstances.  (Ref: Para. A31)

The firm shall establish policies and procedures designed to provide it with reasonable assurance that engagements are performed in accordance with AUASB Standards, relevant ethical requirements, and applicable legal and regulatory requirements, and that the firm or the engagement partner issue reports that are appropriate in the circumstances.  Such policies and procedures shall include:

1. Matters relevant to promoting consistency in the quality of engagement performance; (Ref: Para. A32‑A33)
2. Supervision responsibilities; and  (Ref: Para. A34)
3. Review responsibilities.  (Ref: Para. A35)

The firm’s review responsibility policies and procedures shall be determined on the basis that work of less experienced engagement team members is reviewed by more experienced engagement team members.

Consultation

The firm shall establish policies and procedures designed to provide it with reasonable assurance that:

1. Appropriate consultation takes place on difficult or contentious matters;
2. Sufficient resources are available to enable appropriate consultation to take place;
3. The nature and scope of, and conclusions resulting from, such consultations are documented and are agreed by both the individual seeking consultation and the individual consulted; and
4. Conclusions resulting from consultations are implemented; or

The reasons alternative courses of action from consultations were undertaken, are documented.  (Ref: Para. A36‑A40)

Engagement Quality Control Review

The firm shall establish policies and procedures requiring, for appropriate engagements, an engagement quality control review that provides an objective evaluation of the significant judgements made by the engagement team and the conclusions reached in formulating the report.  Such policies and procedures shall:

1. Require an engagement quality control review for all audits of financial reports of listed entities;
2. Set out criteria against which all other audits and reviews of historical financial information, other assurance engagements and related services engagements shall be evaluated to determine whether an engagement quality control review should be performed; and  (Ref: Para. A41)
3. Require an engagement quality control review for all engagements, if any, meeting the criteria established in compliance with subparagraph 35(b) of this Standard.

The firm shall establish policies and procedures setting out the nature, timing and extent of an engagement quality control review.  Such policies and procedures shall require that the engagement report not be dated until the completion of the engagement quality control review.  (Ref: Para. A42‑A43)

The firm shall establish policies and procedures to require the engagement quality control review to include:

1. Discussion of significant matters with the engagement partner;
2. Review of the financial report or other subject matter information and the proposed report;
3. Review of selected engagement documentation relating to significant judgements the engagement team made and the conclusions it reached; and
4. Evaluation of the conclusions reached in formulating the report and consideration of whether the proposed report is appropriate.  (Ref: Para. A44)

For audits of financial reports of listed entities, the firm shall establish policies and procedures to require the engagement quality control review to also include consideration of the following:

1. The engagement team’s evaluation of the firm’s independence in relation to the specific engagement;
2. Whether appropriate consultation has taken place on matters involving differences of opinion or other difficult or contentious matters, and the conclusions arising from those consultations; and
3. Whether documentation selected for review reflects the work performed in relation to the significant judgements made and supports the conclusions reached.  (Ref: Para. A45‑A46)

Criteria for the Eligibility of Engagement Quality Control Reviewers

The firm shall establish policies and procedures to address the appointment of engagement quality control reviewers and establish their eligibility through:

1. The technical qualifications required to perform the role, including the necessary experience and authority; and  (Ref: Para. A47)
2. The degree to which an engagement quality control reviewer can be consulted on the engagement without compromising the reviewer’s objectivity.  (Ref: Para. A48)

The firm shall establish policies and procedures designed to maintain the objectivity of the engagement quality control reviewer.  (Ref: Para. A49‑A51)

The firm’s policies and procedures shall provide for the replacement of the engagement quality control reviewer where the reviewer’s ability to perform an objective review may be impaired.

Documentation of the Engagement Quality Control Review

The firm shall establish policies and procedures on documentation of the engagement quality control review which require documentation that:

1. The procedures required by the firm’s policies on engagement quality control review have been performed;
2. The engagement quality control review has been completed on or before the date of the report; and
3. The reviewer is not aware of any unresolved matters that would cause the reviewer to believe that the significant judgements the engagement team made and the conclusions it reached were not appropriate.

Differences of Opinion

The firm shall establish policies and procedures for dealing with and resolving differences of opinion within the engagement team, with those consulted and, where applicable, between the engagement partner and the engagement quality control reviewer.  (Ref: Para. A52‑A53)

Such policies and procedures shall require that:

1. Conclusions reached be documented and implemented; and
2. The date of the report cannot be earlier than the date on which the matter is resolved. 

Engagement Documentation

Completion of the Assembly of Final Engagement Files

The firm shall establish policies and procedures for engagement teams to complete the assembly of final engagement files on a timely basis after the engagement reports have been finalised.  (Ref: Para. A54‑A55)

Confidentiality, Safe Custody, Integrity, Accessibility and Retrievability of Engagement Documentation

The firm shall establish policies and procedures designed to maintain the confidentiality, safe custody, integrity, accessibility and retrievability of engagement documentation.  (Ref: Para. A56‑A59)

Retention of Engagement Documentation

The firm shall establish policies and procedures for the retention of engagement documentation for a period sufficient to meet the needs of the firm or as required by law or regulation.  (Ref: Para. A60‑Aus A63.1)

Monitoring the Firm’s Quality Control Policies and Procedures

The firm shall establish a monitoring process designed to provide it with reasonable assurance that the policies and procedures relating to the system of quality control are relevant, adequate, and operating effectively.  This process shall:

1. Include an ongoing consideration and evaluation of the firm’s system of quality control including, on a cyclical basis, inspection of at least one completed engagement for each engagement partner;
2. Require responsibility for the monitoring process to be assigned to a partner or partners or other persons with sufficient and appropriate experience and authority in the firm to assume that responsibility; and
3. Require that those performing the engagement or the engagement quality control review are not involved in inspecting the engagements.  (Ref: Para. A64‑Aus A68.1)

Evaluating, Communicating and Remedying Identified Deficiencies

The firm shall evaluate the effect of deficiencies noted as a result of the monitoring process and determine whether they are either:

1. Instances that do not necessarily indicate that the firm’s system of quality control is insufficient to provide it with reasonable assurance that it complies with AUASB Standards, relevant ethical requirements, and applicable legal and regulatory requirements, and that the reports issued by the firm or engagement partners are appropriate in the circumstances; or
2. Systemic, repetitive or other significant deficiencies that require prompt corrective action.

The firm shall communicate to relevant engagement partners and other appropriate personnel deficiencies noted as a result of the monitoring process and recommendations for appropriate remedial action.  (Ref: Para. A69)

Recommendations for appropriate remedial actions for deficiencies noted shall include one or more of the following:

1. Taking appropriate remedial action in relation to an individual engagement or member of personnel;
2. The communication of the findings to those responsible for training and professional development;
3. Changes to the quality control policies and procedures; and
4. Disciplinary action against those who fail to comply with the policies and procedures of the firm, especially those who do so repeatedly.

The firm shall establish policies and procedures to address cases where the results of the monitoring procedures indicate that a report may be inappropriate or that procedures were omitted during the performance of the engagement.  Such policies and procedures shall require the firm to determine what further action is appropriate to comply with relevant AUASB Standards, relevant ethical requirements, and applicable legal and regulatory requirements, and to consider whether to obtain legal advice.

The firm shall communicate at least annually the results of the monitoring of its system of quality control to engagement partners and other appropriate individuals within the firm, including the firm’s chief executive officer or, if appropriate, its managing board of partners.  This communication shall be sufficient to enable the firm and these individuals to take prompt and appropriate action where necessary in accordance with their defined roles and responsibilities.  Information communicated shall include the following:

1. A description of the monitoring procedures performed.
2. The conclusions drawn from the monitoring procedures.
3. Where relevant, a description of systemic, repetitive or other significant deficiencies and of the actions taken to resolve or amend those deficiencies.

Some firms operate as part of a network and, for consistency, may implement some of their monitoring procedures on a network basis.  Where firms within a network operate under common monitoring policies and procedures designed to comply with this Standard, and these firms place reliance on such a monitoring system, the firm’s policies and procedures shall require that:

1. At least annually, the network communicate the overall scope, extent and results of the monitoring process to appropriate individuals within the network firms; and
2. The network communicate promptly any identified deficiencies in the system of quality control to appropriate individuals within the relevant network firm or firms so that the necessary action can be taken,

in order that engagement partners in the network firms can rely on the results of the monitoring process implemented within the network, unless the firms or the network advise otherwise.

Complaints and Allegations

The firm shall establish policies and procedures designed to provide it with reasonable assurance that it deals appropriately with:

1. Complaints and allegations that the work performed by the firm fails to comply with AUASB Standards, relevant ethical requirements, and applicable legal and regulatory requirements; and
2. Allegations of non‑compliance with the firm’s system of quality control. 

As part of this process, the firm shall establish clearly defined channels for firm personnel to raise any concerns in a manner that enables them to come forward without fear of reprisals.  (Ref: Para. A70)

If during the investigations into complaints and allegations, deficiencies in the design or operation of the firm’s quality control policies and procedures or non‑compliance with the firm’s system of quality control by an individual or individuals are identified, the firm shall take appropriate actions as set out in paragraph 51 of this Standard.  (Ref: Para. A71‑A72)

The firm shall establish policies and procedures requiring appropriate documentation to provide evidence of the operation of each element of its system of quality control.  (Ref: Para. A73‑A75)

The firm shall establish policies and procedures that require retention of documentation for a period of time sufficient to permit those performing monitoring procedures to evaluate the firm’s compliance with its system of quality control, or for a longer period if required by law or regulation.

The firm shall establish policies and procedures requiring documentation of complaints and allegations and the responses to them.