Example quality management Appendix 2

policy

[Insert Name of Firm] __________________

Contents
1 Introduction
2 Hong Kong Standard on Quality Management 1
3 Governance and leadership
4 Relevant ethical requirements
5 Acceptance and continuance of client relationships and specific engagements
6 Engagement performance
7 Resources
8 Information and communication
9 The monitoring and remediation of the system of quality management
10 Evaluating the system of quality management

Notes:
1. This document is presented as an example of a firm’s Quality Management Policy. Firms should tailor
their policies and procedures based on the firm’s nature and circumstances in accordance with
paragraph 19 of HKSQM 1, and demonstrate that those policies and procedures are implemented in
practice as part of the firm’s quality management system.
2. This example policy does not include those relating to network requirements or network services set
out in paragraphs 48 to 52 of HKSQM 1. Firms belonging to a network should develop relevant
policies and procedures according to HKSQM 1.
3. Some of the policies and procedures of a firm’s quality control under HKSQC 1 may still be relevant
and appropriate for the firm’s new quality management manual under HKSQM 1.
4. Texts in the right-hand column are references to HKSQM 1, HKSA 220 (Revised) or othre guidance.
Example of abbreviation used:
 1.6: Paragraph 6 of HKSQM 1
 1.34(a)(i): Paragraph 34(a)(i) of HKSQM 1

Page 1 QMM Appendix 2

  220.13 – 14: Paragraph 13 and 14 of HKSA 220 (Revised)
 Code: Code of Ethics for Professional Accountants issued by the HKICPA
 QMM Appendix 3: Appendix 3 accompanying the HKICPA Quality Management Manual
5. Shaded areas included within the square brackets [ ] should be customized by the firm according to
the firm’s policies.
6. References will need to be tailored appropriately for the adopted professional standards, regulations,
methodology etc.

Page 2 QMM Appendix 2

1 INTRODUCTION

This policy is last reviewed/ updated on: [Insert Date] and effective as of [Insert Date].
This policy was circulated to all professional staff of the firm on [Insert Date].

This policy is developed in accordance with the following pronouncements for the firm
and individual engagements:
• Code of Ethics for Professional Accountants issued by the Hong Kong Institute of
Certified Public Accountants (the “Code”);
• Hong Kong Standard on Quality Management (“HKSQM”) 1, Quality Management for
Firms that Perform Audits or Reviews of Financial Statements, or Other Assurance
Related or Related Services Engagement;
• HKSA 220 (Revised), Quality Management for an Audit of Financial Statements.
• [Insert details as appropriate].
The firm has in place a separate engagement quality (EQ) review policy set out in [insert
location where it is located] which is outside this policy.
The firm acknowledges that other pronouncements of the Hong Kong Institute of Certified
Public Accountants (the “HKICPA”) Auditing and Assurance Standards Committee:
(a) Are premised on the basis that the firm is subject to the HKSQMs or to local
requirements that are at least as demanding; and

(b) Include requirements for engagement partners and other engagement team members
regarding quality management at the engagement level. For example, HKSA 220
(Revised) deals with the specific responsibilities of the auditor regarding quality
management at the engagement level for an audit of financial statements and the
related responsibilities of the engagement partner.
[Chapter 4] of this policy explains the requirements of the Code.
The necessary procedures in relation to HKSA 220 (Revised) are included in [section 6 in
the guidance notes of the firm’s Quality Management Manual].

The Firm’s System of Quality Management

The firm’s system of quality management includes policies and procedures addressing 1.6
each of the following elements:
• Governance and leadership (see chapter 3);
• Relevant ethical requirements (see chapter 4);
• Acceptance and continuance of client relationships and specific engagements (see
chapter 5);
• Engagement performance (see chapter 6);
• Resources (see chapter 7);
• Information and communication (see chapter 8);
• Monitoring and remediation (see chapter 9); and
• Evaluation of the system of quality management (see chapter 10).
No partner, director, member or shareholder of the firm (or network firm if applicable)

Page 3 QMM Appendix 2

 should intervene the carrying out of an engagement in any way which would jeopardize
the firm’s independence and objectivity in carrying out such work.
The firm encourages partners and staff to communicate their views or concerns on quality
management matters.
This policy and the relevant appendices and documents comprises the firm’s quality
management policies and procedures.

Documentation

This documentation of the firm’s system of quality management is designed to:

• Support a consistent understanding of the system of quality management by 1.57(a)
personnel, including an understanding of their roles and responsibilities with respect
to the system of quality management and the performance of engagements;
• Support the consistent implementation and operation of the procedures implemented
in response to the quality risks identified by the firm’s risk assessment process; and 1.57(b)
• Provide evidence of the design, implementation and operation of those responses, in
order to support the evaluation of the system of quality management by the
1.57(c)
individual(s) assigned ultimate responsibility and accountability for the system of
quality management.
In doing so the documentation prepared includes:
• The identification of the individual(s) assigned ultimate responsibility and
accountability for the system of quality management and operational responsibility for
the system of quality management as documented in [chapter 3 of this policy]; 1.20(a)-(c)

• The firm’s quality objectives and quality risks, as identified by a risk assessment 1.23–1.27
process carried out in accordance with HKSQM 1, and a description of the responses QMM
implemented in respect of the identified quality risks, and how those responses Appendix
address those quality risks are not included in this policy. They are maintained at 3
[insert location where these are documented and maintained];
• Regarding the monitoring and remediation process:
QMM
- Evidence of the monitoring activities performed; Appendix
- The evaluation of findings, and identified deficiencies and their related root 7
cause(s);
- Remedial actions to address identified deficiencies and the evaluation of the
design and implementation of such remedial actions; and
- Communication about monitoring and remediation; and
- The basis for the conclusion reached by the individual(s) assigned ultimate
responsibility and accountability for the system of quality management on the
system’s ability to ensure that the firm’s quality objectives are being achieved.
They are documented and maintained at [insert location where these are
documented and maintained]
• In respect of documentation, the firm’s policies,
- Require the retention of engagement documentation in compliance with HKSQM
1 and other applicable legal requirements for a period set out in [chapter 6 of this
policy];
- Requires documentation of:

Page 4 QMM Appendix 2

 - Whether the firm has complied with relevant ethical requirements;
- Whether there any threats to independence and the safeguards in place
applied to mitigate those threats in place;
- Whether the firm has competent personnel and appropriate time and
resources needed to perform engagements in an appropriate manner; and;
- Whether the engagement partner(s) is/are eligible for appointment as auditor.
They are documented and maintained at [insert location, e.g., current file of
respective engagements].
We also maintain a record which includes for every engagement: the entity’s name,
address and place of business; name of the engagement partner; and the fees charged
for carrying out the engagement and for other services provided in any financial year. The
record is located at [insert location, e.g., current file of respective engagements].
Further our procedures require us to keep records of:
• Any complaints received about the performance of the engagements carried out;
• The findings of the annual evaluation of the internal quality management system and
any proposed measures to modify the system;
• Any breaches (other than those considered to be minor in nature) of professional
standards and applicable legal and regulatory requirements, including breaches
against the Code; and
• Any consequences arising from a recorded breach, including the measures taken to
address such a breach and any modifications to the firm’s internal quality
management system.
The above polices are set out in [chapter 9 of this policy] and their records are maintained
at [insert details of where the records are located].
As set out in [chapter 9 of this policy], we prepare an annual report which contains an
overview of any measures taken in consequence of any breaches that arise and we
communicate that report internally. The annual report is filed at [insert details of where it
is located]. 1.60
The firm’s documentation for the system of quality management is retained for [insert
number of years], which is considered as a sufficient period of time to enable those who
monitor the procedures to evaluate the firm’s compliance with our system of quality
management[, and is in accordance with [insert applicable laws and regulations]].
[For network firms: In documenting our system of quality management we take into
account the requirements of the network to which we belong.]

Page 5 QMM Appendix 2

2 HONG KONG STANDARD OF QUALITY MANAGEMENT 1

Introduction

We have established a system of quality management designed to ensure that the firm 1.14, 1.19
and its personnel comply with professional standards and applicable legal and regulatory
requirements, and that reports issued by the firm or engagement partners are appropriate
in the circumstances. In doing so we have exercised professional judgement, taking into
account the nature and circumstances of the firm and its engagements.
The governance and leadership section of this policy [in chapter 3] establishes the
1.19
environment that supports the design, implementation and operation of the system of
quality management.

Responsibilities

Designated personnel within the firm who have responsibility for the system of quality
management are required to have an understanding of the entire text of HKSQM 1. This
includes the following individual(s):

[Name of the firm’s chief executive officer

The individual(s) assigned ultimate 1.20(a)
or managing partner (or equivalent), or if
responsibility and accountability for the
appropriate the firm’s managing board of
firm’s system of quality management:
partners (or equivalent)]

The individual(s) assigned operational

responsibility for the firm’s system of [Name]
1.20(b)
quality management:

The individual(s) assigned operational

responsibility for specific aspects of the
firm’s system of quality management: 1.20(c)
[Name]
- Compliance with independence
requirements [Name]
- The monitoring and remediation
[Name]
process
- [Insert details as appropriate]

The assessment of the above individual(s) for appointment to the relevant roles are
recorded at [insert location], which have been reviewed, signed-off and appointed by
[insert details, e.g., the firm’s managing board of partners], having considered that the
assigned individual(s):
(a) Has the appropriate experience, knowledge, influence and authority within the firm, 1.21(a)
and sufficient time, to fulfill their assigned responsibility; and
(b) Understands their assigned roles and that they are accountable for fulfilling them.
1.21(b)
We also ensure that the assignee(s) has sufficient time and resource to be able to
perform their role effectively.
The above individual(s) assigned with operational responsibility for the system of quality
management, compliance with independence requirements and the monitoring and
remediation process, have a direct line of communication to the individual(s) assigned

Page 6 QMM Appendix 2

 ultimate responsibility and accountability for the system of quality management. 1.22
The firm’s appraisal process for the above persons shall take into account the evaluation
of the system of quality management. It is set out in [chapter 10] of this policy.

Page 7 QMM Appendix 2

3 GOVERNANCE AND LEADERSHIP
The firm is committed to establishing a firm-wide culture, based on the recognition that a
commitment to quality is essential in performing all engagements. In seeking to achieve
this the firm acknowledges:
• The role in serving the public interest by consistently performing quality engagements;
1.28(a)(i)
• The importance of professional ethics, and values and attitudes that reinforce the
culture of the firm to commit to quality in all that we do; 1.28(a)(ii)
• The responsibility of all personnel for quality relating to the performance of
engagements or activities within the system of quality management, from the firm’s 1.28(a)(iii)
managing partner through to the most inexperienced member of staff; and
• The importance of quality in setting the firm’s strategic decisions and actions,
including our financial and operational priorities. 1.28(a)(iv)

The firm’s leadership is responsible and accountable for quality, and that their actions and
behaviors should demonstrate their commitment to quality. As such our policies and 1.28(b)-
procedures require [insert details, e.g., the firm’s managing partner] to assume ultimate (d)
responsibility for the firm’s systems of quality management, supported by [insert details,
e.g., the other members of the firm’s management board and the wider body of partners].
The assignment of relevant roles to the firm’s systems of quality management is set out in
[insert details, e.g., chapter 2 of this policy].
We are aware of the professional competence requirements of [insert details, e.g.,
HKICPA Statement 1.500 (Revised), Continuing Professional Development] and ensure
that engagement partner(s) undertakes a learnings outcome approach though Continuing
Professional Development (CPD). This ensures they undertake a programme of
continuing education in audit to maintain their theoretical knowledge, professional skills
and values to a sufficiently high level.
The culture of a commitment to quality is achieved and maintained by the communication
of consistent messages on the importance of quality management throughout [insert 1.28(a)
details, e.g., internal circulars, meetings, training seminars and staff appraisals].
All changes to our audit procedures are authorized by [insert details, e.g., those with
operational responsibility for the system of quality management]. Any issues relating to
audit quality are brought to their attention as soon as practicable.
Sufficient time and resources are allocated to the development and documentation of the
firm’s quality management policies and procedures. 1.28(e)
The responsibility for individual engagements rests with the relevant engagement
partners, who are responsible for ensuring that relevant auditing, assurance and ethical
standards and other regulatory requirements are complied with on their individual
assignments, and relevant documentations maintained in respective engagement files.
For audit engagements, the engagement partner shall take overall responsibility for
managing and achieving quality on the audit engagement, including taking responsibility
for creating an environment for the engagement that emphasizes the firm’s culture and 220.13-14
expected behavior of engagement team members. The engagement partner shall be
sufficiently and appropriately involved throughout the audit engagement such that the
engagement partner has the basis for determining whether the significant judgments
made, and the conclusions reached, are appropriate given the nature and circumstances
of the engagement.

Page 8 QMM Appendix 2

4 RELEVANT ETHICAL REQUIREMENTS

The firm has established policies and procedures designed to provide it with reasonable 1.29
assurance that the firm and its partners and staff comply with relevant ethical requirements
contained in [the Code] [and] [specify name(s) or title(s) of other relevant ethical
requirements].
The firm has appropriate and effective arrangements in place for dealing with and
recording incidents which have, or may have, serious consequences for the integrity of the
firm’s activities. Once the incidents are identified, the procedures are [insert details, e.g.,
the same as handling complaints and allegations set out in chapter 9 of this policy].
The Code establishes the fundamental principles as: Code
• Integrity;
• Objectivity;
• Professional competence and due care;
• Confidentiality; and
• Professional behavior.
The Code also requires professional accountants to be independent when performing Code
audit, review and other assurance engagements. The conceptual framework of the Code
applies in the same way to identifying, evaluating and addressing threats to independence
as to threats to compliance with the fundamental principles.

Integrity

[Insert the firm’s policies or refer to another source as appropriate]

Objectivity

[Insert the firm’s policies or refer to another source as appropriate]

Professional competence and due care

In order to establish professional competence and due care, our policies and procedures
cover the following areas:
(a) Fit and proper status;
(b) Technical training;
(c) On the job training;
(d) Performance appraisal; and
(e) Recruitment.

(a) Fit and proper status

Our procedures ensure that the firm and individuals involved in professional work for
the firm are fit and proper.

Page 9 QMM Appendix 2

 The [insert details, e.g., ethics partner; managing partner] should complete the firm’s fit
and proper form at [Appendix 5] annually as part of the annual evaluation of the firm’s
system of quality management.
Similarly, all individuals within the firm must complete an annual declaration form at
[Appendix 4] providing information regarding their:
• Financial integrity and reliability;
• Civil liabilities;
• Good reputation and character; and
• Disciplinary records with regulatory bodies / authorities.
Everyone who is or will be employed by, or associated with, the firm in connection with
the firm’s engagement work must be fit and proper, therefore the annual declaration
procedures cover:
• Partners;
• Employees;
• Consultants;
• Subcontractors; and
• Anyone else whose work we rely on when carrying out audit work.
Confirmation of the fit and proper status is obtained from all professional staff who join
the firm and the form will be completed by all personnel on an annual basis.
The information is considered by [insert details, e.g., ethics partner; managing partner]
for the firm as a whole if a potential problem is identified.
If the firm is unsure how information provided affects its fit and proper status it seeks
advice from [insert details, e.g., relevant regulatory body; legal counsel] for further
action.
(b) Technical training
Adequate training involves:
• The acquisition and retention of the requisite knowledge;
• The regular updating of the requisite knowledge;
• Fostering the spirit of professional integrity and objectivity in which the knowledge
should be applied;
• The ability and techniques involved in applying the knowledge in a practical way;
and
• Familiarity with the firm’s supervision and disciplinary procedures and back up
arrangements for detecting and assisting the individual acting at or beyond the
boundaries of his or her competence.
• [Insert details as appropriate].
Training for a professional qualification is outside the scope of this policy. This policy
concerns with the firm’s procedures regarding the practical training of individuals, i.e.,
ensuring they are capable of undertaking and do undertake the firm’s procedures up to
the required standards at all times.
The firm provides a [insert details, e.g., quarterly circular] which provides a summary of
important regulatory and technical changes that might affect the firm. It provides a

Page 10 QMM Appendix 2

 cross-reference to the source of further information. These sources are available within
the firm’s library and reference should be made as required.
[Additional circulars and guidance are issued by the firm where it is considered
necessary. These include summaries of and guidance on:
• Legislative changes;
• Regulatory changes relating to audit clients; and
• Important pronouncements on ethics, auditing and accounting matters.
• [Insert other details as appropriate]]
The firm maintains [insert details, e.g., an electronic/ paper/ hybrid] library. Within it
there are copies of:
• All relevant auditing, accounting and ethical standards;
• Reference books relevant to the work of professional accountants; and
• Other reference material considered relevant.
• [Insert other details as appropriate].
These materials should be referred to by all individuals as required.
Junior members of staff attend [insert details, e.g., the practical training programme
organized by [name]]. This structured and progressive programme ensures all
professional staff are given thorough training in:
• The basic accountancy and auditing skills required;
• The legal and regulatory framework within which the firm operates; and
• The firm’s standard procedures and how to apply them in practice.
• [Insert other details as appropriate].
In addition, the training programme enables the individuals to develop and be capable
of taking a more senior role and additional responsibility. The courses provide
opportunity for staff to put their work into perspective and to clarify any
misunderstanding they may have. Full details of the objectives and content of this
training programme can be obtained from [insert details].
Qualified members of staff must ensure that they meet the specific CPD requirements
of their professional body. To ensure compliance, all professional staff, whether
qualified or not, must be competent to undertake the work assigned to them. This is
assessed by the engagement partner when assigning staff members to respective
work.
Where specialist skills and expertise are perceived as a necessity, the firm will develop
and maintain this expertise by:
• [Sending individuals on specialist external courses, meetings, conferences, etc.;
• Encouraging membership of organizations concerned with such specializations;
and
• Obtaining all available technical literature and support services.
• [Insert other details as appropriate]]

(c) On the job training

Page 11 QMM Appendix 2

 In spite of the importance of the procedures detailed above, the firm recognizes that
the majority of training is provided “on-the-job”. It is therefore necessary to establish
procedures to achieve the required level of such training and to monitor the
effectiveness of such procedures.
As part of the engagement planning, engagement partners must consider the training
needs of staff. This means providing professional staff with exposure to different types
of work and providing them the opportunity to work with more experienced members of
staff.
Once the allocation of work has been made, engagement partners must ensure that:
• [The “junior” staff have learnt what is necessary;
• The “supervisory” staff allocated have the necessary skills, knowledge and
experience to provide the training; and
• Adequate training has been provided.
• [Insert other details as appropriate]]
The engagement partners are responsible to monitor the performance of staff on their
assignments, or delegate the more experienced staff members to perform such
monitoring.
(d) Performance appraisal
All staff should complete the appraisal forms at [Appendix 6] for engagements that they
spend more than [insert details, e.g., 40 working hours] for reviewed by [insert details,
e.g., the next level of individual the staff report to].
The firm undertakes [insert frequency, e.g., half yearly] performance reviews for all QMM
individuals assigned on engagements. The results of appraisals are considered and Appendix
any problems identified are discussed and action decided upon. At such reviews the 6
following criteria will be considered:
• [Technical knowledge;
• Analytical and judgmental abilities;
• Personal skills, e.g., leadership, communication, etc.;
• Relationships, e.g., clients, staff, etc.; and
• Professional qualifications.
• [Insert other details]]
Promotion to the next level of positions is not considered until [insert details, e.g., the
individual displays the level of skill required in each area].
(e) Recruitment
In order to maintain the competence of the firm, we have established adequately
thorough recruitment procedures. Our recruitment process begins with planning for
staffing needs and setting recruitment criteria based on those needs. This ensures that
we recruit staff with suitable qualifications and any necessary expertise in specialist
areas that the firm requires. The early stages of our recruitment process considers:
• [Volume of the firm’s work;
• Types of work at all levels;
• Existing staff structure;
• Methods of work and management of staff; and

Page 12 QMM Appendix 2

 • Any expected changes.
• Insert other details as appropriate].
For each vacancy, we consider the knowledge, experience and personal skills needed,
including:
• [Academic background;
• Professional qualifications;
• Personal achievements;
• Work experience; and
• Personal qualities such as communication skills, motivation, initiative and
interpersonal skills.
• Insert other details as appropriate].
For new employees, we always obtain references from their previous employers if
applicable and ensure that any necessary follow up enquiries are made.
New employees go through an induction process, in accordance with our HR policies
and procedures which are available at [insert details of where these are addressed].
The [insert details, e.g., Head of Human Resources Department] is responsible for co-
ordinating the recruitment needs of the firm.

Confidentiality

 Any information acquired in the course of an engagement must not be disclosed

without the consent of the client unless there are responsibilities under law, regulation
or relevant ethical requirements.
 A key exception to this is any matters in relation to the Anti-Money Laundering and
Counter-Terrorist Financing (AML/CFT) requirements. We have separate procedures
for AML/CFT which are not reproduced here. See [insert details of where these are
addressed].
 There are other exceptions to this confidentiality rule in certain rare situations, but no
member of staff or others involved in auditing should disclose any information without
prior consultation with [insert appropriate details, e.g., the engagement partner; the
ethics partner; the firm’s managing partner].
 A confidentiality confirmation form can be found in [Appendix 4]. This is obtained from
all staff when joining the firm and thereafter the form is completed by all personnel on
an annual basis.

Professional behavior

 All audit personnel must conduct themselves at all times in a professional manner.
This requirement covers how individuals present themselves, conduct themselves in
public and communicate with clients and others.
 If any person is uncertain regarding how this requirement applies in specific
circumstances they should seek guidance from [insert details, e.g., the ethics partner;
the managing partner] of the firm.

Page 13 QMM Appendix 2

Independence

The firm’s independence policies are set out in [insert details of where these are
addressed], which comply with [insert details, e.g., the Code]. These policies and
procedures have been designed to provide us with reasonable assurance that the firm, its
personnel and, where applicable, others subject to independence requirements (including
network firm personnel) maintain independence where required by relevant ethical
requirements.
As a result, we are able to:
• Communicate our independence requirements to relevant personnel; and
• Identify and evaluate circumstances and relationships that create threats to
independence, and to take appropriate action to eliminate those threats or reduce them
to an acceptable level by applying safeguards (or, if considered appropriate, to
withdraw from the engagement, where withdrawal is permitted by law or regulation).

Identifying and responses to compliance with ethical requirements

Identifying, evaluating and addressing threats to compliance with the relevant ethical 1.34(a)(i),
requirements 220.17(a)
 All partners and staff are required to have an understanding of [insert details, e.g., the
Code] and other relevant ethical requirements, along with the requirements of these
220.16
policies and should be able to recognize self-interest, self-review, advocacy, familiarity
and intimidation threats.
 Engagement partners are required to provide the firm with relevant information about
client engagements, including the scope of services, to enable the firm to evaluate the
overall impact, if any, on the firm’s compliance with the relevant ethical and
independence requirements.
 On engagements where specific ethical requirements and/or independence is required,
engagement partners are required to obtain verbal declarations from partners and staff
involved in the engagement that:
i. they are independent of both the client and engagement in accordance with
relevant ethical requirements and firm policies and procedures;
ii. they are not independent of both the client and engagement in accordance
with relevant ethical requirements and firm policies and procedures; or
iii. they are unsure whether they are independent of both the client and
engagement in accordance with relevant ethical requirements and firm policies
and procedures.
Where (ii) or (iii) are declared, the individual concerned should follow this up in writing.
The engagement partner must, in consultation with the individual concerned and others
in the firm as appropriate, assess any threats to independence such that appropriate
safeguards can be applied to eliminate or reduce the threats to an acceptable level.
Such safeguards may include removal of the individual concerned from the
engagement team. Where it is not possible to eliminate or reduce threats to an
acceptable level, the engagement should be declined or the firm should resign as
appropriate, if permitted to do so under relevant laws or regulations. Staff and partners
are required to promptly notify the firm of circumstances and relationships that create a

Page 14 QMM Appendix 2

 threat to independence so that appropriate action can be taken.
Identifying, communicating, evaluating and reporting of any breaches of the relevant ethical 1.34(a)(ii)
requirements and appropriately responding to the causes and consequences of the
breaches
 The firm gathers and communicates the relevant information to appropriate personnel
so that the firm can easily identify potential ethical and/or independence threats and
take appropriate action. A list is maintained by the firm on clients in which investments
are prohibited as independence is required from them and is updated [insert details,
e.g., monthly] based on the review of the latest clients of the firm. The list is maintained
at [insert location where it is located].
 Both the firm and relevant audit staff and partners are required promptly to
communicate possible breaches of independence requirements so that appropriate
actions can be taken to resolve such situations. This includes:
- Personnel notifying the firm of independence breaches of which they become 220.17(b)
aware; and
- The [insert details, e.g., firm’s ethics partner; managing partner] communicating
identified breaches to both the engagement partner who, with the firm, needs to
address the breach and other relevant personnel (including, where appropriate, the
network).
[Insert other policies/procedures on identifying and responses to ethical issues]
 […]
 […]
Documented confirmation of compliance with independence requirements
 In order to monitor independence, all partners, staff, consultants, subcontractors and
others involved in auditing within the firm are required to confirm their compliance with
our policy regarding independence.
 This confirmation is renewed annually and its completion is a necessary condition of
employment. A copy of this compliance form can be found at [Appendix 4]. 1.34(b)

If the monitoring procedures identify situations which might appear to threaten the
individual’s or the firm’s independence, the [insert details, e.g., engagement partner; ethics
partner; managing partner] of the firm would decide what action should be taken.
If it is considered that satisfactory safeguards cannot be achieved, the [insert details, e.g.,
engagement partner; ethics partner; managing partner] would decide if the firm should
cease to act as the auditor or what other action should be taken.
Register of breaches of ethical requirements
The [insert details, e.g., firm’s ethics partner; managing partner] maintains a register of
breaches of ethical requirements from the procedures about at [insert locations where it is
located]. [He/she] also ensures that relevant breaches are reported to the firm's regulatory
body, where required.

Other ethical matters

Other ethical matters to which the firm pays consideration include:

 Publicity and advertising; and

Page 15 QMM Appendix 2

 Obtaining professional work.
These points above are outside the scope of this policy and reference should be made to
[insert appropriate details, e.g. ethics partner; firm’s managing partner] if necessary.
Adherence to all other ethical matters is the responsibility of the partners who have regard
to ethical guidance published by the bodies of which they are members and the
firm’s regulatory body.

Page 16 QMM Appendix 2

5 ACCEPTANCE AND CONTINUANCE OF CLIENT RELATIONSHIPS
AND SPECIFIC ENGAGEMENTS

An important part of quality management is to consider whether the firm should act or
continue to act for an audit client. The matters which require consideration are:
 Whether we are competent to undertake the work and have sufficient time and
resource to do so;
 Whether the engagement partner is eligible for appointment as auditor;
 Our compliance with professional standards, applicable legal and regulatory
requirements including ethical requirements; and
 The integrity and ethical values of the client.
If after accepting an appointment, the firm becomes aware of any facts which would have 1.34(d)(i)
caused the firm to decline the appointment had information had been available earlier, the
firm and the engagement partner to consider:
 The professional and legal responsibilities that apply to the circumstances including
whether there is a requirement for the firm to report to the person or persons who
made the appointment or, in some cases, to regulatory authorities; and
 The possibility of withdrawing from the engagement or from both the engagement and
the client relationship.
When the firm is obligated to accept or continue an engagement or the firm is unable to
withdraw from an engagement, and the firm is aware of information that would have 1.34(d)(ii)
caused the firm to decline or discontinue the engagement, the following should be
undertaken:
 Consider the effect of the information on the performance of the engagement.
 Communicate the information to the engagement partner, and request the engagement
partner to increase the extent and frequency of the direction and supervision of the
engagement team members and review of their work.
 Assign more experienced personnel to the engagement.
 Determine that an engagement quality review should be performed.
 [Insert details as appropriate].
We record our consideration of appointment / reappointment on form [insert reference,
e.g., C2 on the current audit file]. Any safeguards needed to offset identified threats are
recorded on [insert reference, e.g., C2.1 on the current audit file].
We also consider these matters, before the end of our term in office, when deciding
whether we are willing to continue in office as auditor.
These matters are dealt with along with the procedural aspects relating to a change in
appointment [insert details, e.g., in the separate current audit file]. In addition, however, the
firm will apply the following procedures to ensure these matters are considered.
New appointments
 New appointments are only accepted by engagement partners. They have due regard
to [insert details, the Code], the nature and circumstances of the engagement and the
integrity and ethical values of the client and confirm this fact in writing and filed it in the 1.30(a)(i)
current file for record before sending the letter of engagement to new clients. All new

Page 17 QMM Appendix 2

 appointments should be reported to [insert details, e.g., the firm’s managing partner;
the firm’s managing board of partners] for the firm’s record.
 Engagement partners also consider whether the firm has sufficient skills and resources
1.30(a)(ii)
to perform the engagement in accordance with professional standards and applicable
legal and regulatory requirements. This may require obtaining detailed information
regarding a potential client before a decision can be made.
 Engagement partners should adhere to the firm’s AML/CTF procedures to ensure that
sufficient customer due diligence information is obtained, including evidence of the
client’s identity. All considerations on new clients should be recorded on [insert
reference, e.g., PAF04 on the current engagement file].
 The appointment is confirmed by [insert details, e.g., the firm’s managing partner; the
firm’s managing board of partners] in case of the following circumstances:
- The engagement partner considers that consultation is necessary before
accepting the appointment due to possible ethical or other problem (such as a
higher than normal money laundering specific risk assessment);
- The audit is of a listed company or other public interest undertaking; and
- The estimated fee exceeds [insert threshold, e.g., a certain percentage] of the
firm’s gross income.
 On a [insert details, e.g., monthly] basis, the [insert details, e.g., the firm’s managing
partner; the firm’s managing board of partners] circulate to all staff of the firm a list of
new clients who appoint the firm as their auditors or to provide other services. On
receipt of such circulation, any staff who is aware of a potential ethical issue such as
threat to independence should communicate it in accordance with the firm’s
consultation procedures set out in [chapter 6 of this policy].
Reappointment
 For continuing engagements, the engagement partner confirms each year that the
matters detailed under the “New appointment” section above are considered.
 Upon reappointment, engagement partners should consider whether any ethical
position has changed from the previous year, which might require the firm to reconsider
the reappointment. These matters might be considered at the planning stage of the
engagement, including the firm’s ability to perform the engagement and the resources
available for the engagement, before commencing each assignment.
 Changes identified from previous years should be considered and the assessment
recorded. Safeguards apply to identified threats should be recorded on [insert
reference, e.g., C2.1 on the current file].
 Where safeguards are applied to eliminate or reduce an identified threat to an
acceptable level, the documentation should be reviewed and confirmed by [insert
details, e.g., ethics partner; the firm’s managing partner] as satisfactory.
 If a potential problem is identified, the engagement partner considers:
- Consulting others;
- Resigning from the audit; or
- Recommending that reappointment is not sought.
- [Insert other details as appropriate].

Page 18 QMM Appendix 2

6 ENGAGEMENT PERFORMANCE

To achieve the performance of quality engagements, the firm has established the policies
and procedures to address:
• Coaching, supervision and review;
• Consultation;
• Differences of opinion;
• Structure of the audit file;
• Engagement resources;
• Engagement documentation;
• Engagement quality review.

Coaching, supervision and review

Coaching, supervision and review should be conducted in such a way as to enable all
parties to develop as part of the process.
The firm provides guidance on coaching, supervision and review responsibilities, however,
at the engagement level, these responsibilities are ultimately set by the engagement
partner and should reflect the particular needs of both the engagement and the partners 220.30
and staff assigned.
More experienced team members should be responsible for coaching and supervising the
less experienced team members, and work of less experienced team members should be
reviewed by a more experienced team member.
In conducting the review, a reviewer should consider whether the engagement team
member has complied with the firm’s policies and procedures, used the firm’s template
documentation and other resources appropriately, and conducted their work with
appropriate skill, care and attention to detail. They should also consider whether work is
appropriately documented, referenced, dated and consulted upon (where necessary), that
reports reflect the work undertaken and are issued on a timely basis, and that work has
been conducted efficiently, timely and in an organized fashion. Consideration should also
be given as to whether relevant professional standards and ethical requirements have
been adhered to.

Consultation

The firm’s policies and procedures are to ensure that:

• Appropriate consultation takes place on difficult or contentious matters;
• Sufficient resources are available to enable appropriate consultation to take place;
• The nature and scope of, and conclusions resulting from, such consultations are
documented and are agreed by both parties in the consultation; and
• Conclusions resulting from consultations are implemented.
All partners and staff within the firm should demonstrate a willingness to assist one another

Page 19 QMM Appendix 2

in consulting on matters where required or otherwise deemed appropriate. The firm will
ensure that appropriate human, technological and financial resources are made available
to facilitate consultation with those appropriately skilled (whether internally or externally).
Engagement partners must take responsibility to consult on any significant, difficult or
contentious matters identified during the engagement (whether at planning, fieldwork or
completion). They should ensure that appropriate consultation has been undertaken,
determine the nature and scope of the consultations, and conclusions agreed have been
implemented. 220.35(a)-
(d)
Consultation should be with other partners and staff where they have the appropriate
knowledge, experience, competency and authority. If necessary, consultation with suitably
qualified external parties is permitted, where approved by the engagement partner.
Where external consultation is used, this may be sought from other firms within the
network, professional bodies, regulatory bodies, or specialist firms offering such
consultancy services. It may also be necessary to seek legal advice on, for example,
issues relating to ethics, professional conduct, regulatory or other legal matters.
Client confidentiality must be adhered to and the external party should normally be highly
objective, independent and free from any conflict of interest (whether actual or perceived).
Effective consultation requires all those parties to consultation to be provided with all the
relevant facts. Trying to obtain a particular result from the consultation by withholding or
directing the flow of information is not appropriate.
The documentation of the consultation must be agreed by all parties to the consultation
and be sufficiently detailed to enable an understanding of the issue giving rise to the
consultation and the results of the consultation (including conclusions and the basis for
those conclusions, and the recommended course of action).
Where there are multiple consultations, documentation should be sufficiently clear to
highlight the range of options or opinions received, along with the final conclusions reached
and the rationale for these.
Where external parties are used for consultation purposes, details of their qualifications,
skills and experience should also be recorded.
Consultation taken place, including background of the issue, consultation sought and the
engagement team’s conclusion and action, should be recorded at [insert details, e.g., the
current engagement file].

Differences of opinion

The firm has established policies and procedures for dealing with and resolving differences 220.37
of opinion within the engagement team, with those consulted and, where applicable,
between the engagement partner and the engagement quality reviewer (see below). The
nature and scope of consultations undertaken and conclusions reached should be
documented and implemented. A report is not issued unless or until such matters are
resolved.
In seeking to resolve differences of opinion in a non-confrontational and timely basis,
partners and staff must aim to be reasonable, open-minded, objective and conscientious.
Differences of opinion commonly arise on matters such as interpretation or application of
applicable standards (e.g., Hong Kong Financial Reporting Standards; Hong Kong
Standards on Auditing; the Code), changes in firm practices, policies and structures,
considering the economic substance of transactions, the suitability and competency of

Page 20 QMM Appendix 2

personnel, and difficult or contentious matters subject to consultation or quality review.
In the first instance the parties to the differences of opinion should discuss the matter
between them, ensuring each party is fully aware of all relevant facts to make an informed
assessment. Each party should be prepared to listen fully to the opinions of the other.
Where it is not possible for a difference of opinion to be resolved between these parties,
and the matter relates to a particular engagement, it should be referred to a more senior
member of the engagement team or the engagement partner. Where such a matter relates
to professional oversight or practice administration within the firm, it should be referred to
the partner responsible for this area. The engagement partner or partner responsible for
the particular area, as appropriate, should be provided with all relevant facts and should
determine, in consultation with the parties to the differences of opinion, the appropriate
resolution. The parties to the differences of opinion should be informed as to the resolution 220.38
proposed and rationale for it.
Should a party to the dispute not be satisfied with the resolution, they should consider
whether to refer the matter to the managing partner, the highest level of authority within the
firm. Their consideration should factor in the significance of the matter to the quality
management as referring a matter to this level of management is serious and could take
considerable time and cost to resolve. If they determine that they wish to make such a
referral, this should usually be in writing.
The [insert details, e.g., managing partner] will consider the matter and, where they
consider necessary, consult with others as appropriate. The parties involved will be
informed of the outcome as soon as is reasonably practicable.
If a party to the dispute is still not satisfied with the resolution, the party will need to
consider the significance of the matter, along with their professional responsibilities and
position or continuing employment with the firm.
The engagement partner takes responsibility for differences of opinion being addressed
and resolved in accordance with those policies and procedures, determine that conclusions
reached are documented and implemented, and not date the report until any differences of
opinion are resolved.
Documentation of differences of opinion should include background of the issue, resolution
taken and the engagement team’s conclusion and action. It should be recorded at [insert
details, e.g., the current engagement file].
The firm is committed to protecting all partners and staff are from any form of retribution,
career limitation, or punitive actions for bringing attention to a legitimate and significant
issue, in good faith and with the true interests of the public, client, firm, or co-worker in
mind.

Structure of the audit file

The firm makes available to engagement teams template working papers for use on
engagements. The firm ensures that these templates are kept up to date for changes in
professional standards, laws and regulations, and notifies partners and staff of any such
changes.
Partners and staff should use these templates, tailored as appropriate, for all engagements
to aid quality and to assist in ensuring that all relevant requirements are met.

Engagement resources

Page 21 QMM Appendix 2

[Insert details, e.g., the firm’s managing partner] is responsible to assign partner to
respective engagements. In the allocation, [he/she] follows the [checklists/procedures] set
out at [insert location] to ensure that the engagement partner has the necessary
competence, is aware of their responsibilities, is known to the management of the client
and has sufficient time and support to perform the role effectively.

When audit work is assigned to personnel, the audit engagement partner must consider the
level of technical training and proficiency required by the personnel in order for the 220.25
assignment to be carried out competently. Appropriate personnel are then assigned having
regard to their previous experience and technical training.

The audit engagement partner must ensure that delegated work meets the firm’s standards
of quality. This is achieved by:

• Providing direction to the audit work by way of the audit plan;

• Ensuring there is sufficient supervision of the audit work being carried out; and

• Establishing procedures so that all audit work is properly reviewed.

Resource needs, including financial resources, are planned for and obtained, allocated or
assigned in a manner that is consistent with the firm’s commitment to quality.

Engagement documentation

Assembly of final engagement files

 Where laws or regulations prescribe time limits by which our final engagement files
must be complete, engagement partners ensure that these deadlines are met. Where
no such time limits are prescribed, our policy is to ensure that as a minimum, audit files
are finalized within 60 days of the date of the audit report.
Confidentiality, safe custody, integrity, accessibility and retrievability of engagement
documentation
 Our procedures in respect of confidentiality are set out in [chapter 4] above. All staff
are required to observe the confidentiality of information contained in engagement
documentation unless specific client authority has been given to disclose information,
or there is a legal or professional requirement to do so.
 As a firm, we have established policies and procedures to ensure that completed
engagement documentation:
- Remains intact;
- Is accessible; and
- Is not altered, added to or deleted without our knowledge.
 These policies and procedures are designed to maintain confidentiality and
professional secrecy in relation to all information and documents to which the firm has
access and ensure it complies with applicable legal and regulatory requirements in this
regard.
Retention of audit engagement documentation
 Engagement documentation should be:

Page 22 QMM Appendix 2

 - Retained for a sufficient period of time to enable those who monitor the procedures
to evaluate the firm’s compliance with our system of quality management; and
- Retained for a period to meet the requirements of any applicable administrative
and/or judicial proceedings, and not less than [insert number of years of the
retention period, e.g., five years] starting from the date of the engagement report,
or, if later, the date of the auditor’s report on the group financial statements, when
applicable. Throughout this period the working papers remain accessible.
 Any changes made to completed documentation after the signing of the audit report
are exceptional and should be clearly marked with:
- The date of the change;
- The name of the person making the change;
- Where necessary, evidence of approval of the change by the engagement partner;
- A clear explanation of the reasons for the change, including the circumstances
encountered and the new or additional audit procedures performed, audit evidence
obtained and conclusions reached; and.
- [Insert other requirements according to the firm’s policies]
 At the end of the retention period, [insert details, e.g., the engagement partner] review
the contents of the engagement file before destruction is authorized by [insert details,
e.g., the firm’s with ultimate responsibility and accountability for the firm’s system of
quality management]. This review should include a consideration of the likelihood that
some papers in the engagement file may serve another purpose, for example, [insert
details, e.g., for the client’s taxation services purposes], where a longer retention
period may apply.
 A central record is kept at [insert location] of files that have been destroyed.
Access to audit engagement documentation
 Access to completed documentation is allowed for authorized external parties in the
following circumstances:
[Insert details, e.g., As part of the regulatory review by a regulatory body].

Engagement quality review

The firm has in place a separate Engagement Quality (EQ) Review policy [at Appendix 14] 1.34(f)
which addresses the following:
 The scope of the engagements performed by the firm that require an EQ review;
 The criteria for the eligibility of EQ reviewers;
 The process for appointing the EQ reviewer to a particular engagement; and
The procedures to be performed as part of an EQ review.

Page 23 QMM Appendix 2

7 RESOURCES

The firm has established policies and procedures to ensure that it has sufficient resources
to be able to perform its engagements in accordance with professional standards and
applicable laws or regulations, and to enable the firm or engagement partners to issue
reports that are appropriate in the circumstances.
These policies and procedures cover the following areas:
 Human resources;
 Technological resources;
 Intellectual resources; and
 Service providers.

Human resources

The firm has established policies and procedures to ensure it has sufficient personnel with
the competence, capabilities and commitment to ethical principles necessary to perform its
engagements in accordance with professional standards and applicable legal and
regulatory requirements, and to enable the firm or engagement partners to issue reports
that are appropriate in the circumstances.
These policies and procedures ensure that all personnel involved in the engagements have
appropriate knowledge and experience for the duties assigned and our compensation
policies provide sufficient performance incentives to secure quality. In case of audit
engagements, these compensation policies do not include remuneration linked to providing
non-assurance services.
These policies and procedures include:
 Capabilities and competence;
 Performance evaluation; and
 Recruitment.
Details of these procedures are included in [chapter 4 of this policy]. Our policies and
procedures also include:
 Career development;
 Promotion;
 Compensation; and
 Estimation of personal needs.
Details of these are outside the scope of this policy and reference should be made to
[insert details, e.g., the HR Department] if necessary.

Assignment of engagement teams

Page 24 QMM Appendix 2

The responsibility for each engagement is assigned to an engagement partner.
Engagement partners should ensure that the identity and role of the audit engagement
partner are communicated to key members of client management and, if different, those
charged with governance.
The [Insert details, e.g., firm’s managing partner; firm’s board of managing partners] is
responsible to assign partners to different engagements. The main criteria used to
determine the assignment are whether the partners have the appropriate competence,
capabilities and authority to perform the role, including their compliance with relevant
ethical and independence requirements.
The firm also ensures that sufficient resources and appropriate staff are assigned to each
engagement. Staff assigned have the necessary competence and capabilities to perform 220.25 –
engagements in accordance with professional standards and applicable legal and 26
regulatory requirements, and to enable the firm or engagement partners to issue reports
that are appropriate in the circumstances. The engagement partner should ensure that the
engagement has sufficient resources and appropriate personnel who have the necessary
competence and capabilities.

Technological resources

The firm utilizes a number of technological resources in its system of quality management,
including:
 Completion and retention of engagement documentation;
 Applications utilized in the performance of engagement, such as data analytics tools;
 Storage of the firm’s technical library; and
 Completion and retention of personnel records such as annual independence
declaration; staff appraisal documentation, etc.
 [Insert details as appropriate]
All IT hardware and software acquisitions are subject to rigorous evaluation to ensure that
they will meet the needs of the firm and the quality objective that appropriate technological
resources are obtained or developed, implemented, maintained, and used to enable the
operation of the firm’s system of quality management and the performance of
engagements. These policies and procedures include:
 That data inputs are complete and appropriate;
 Confidentiality of data is preserved;
 The IT application operates as designed and achieves the purpose for which it is
intended;
 The outputs of the IT application achieve the purpose for which they will be used;
 The general IT controls necessary to support the IT application’s continued operation
as designed area appropriate;
 The need for specialized skills to utilize the IT application effectively, including the
training of individuals who will use the IT application; and
 The need to develop procedures that set out how the IT application operates.

Page 25 QMM Appendix 2

Details of these are outside the scope of this policy and reference should be made to
[insert details, e.g., the IT Department] if necessary.
No IT hardware or software shall be utilized without first determining that they operate
appropriately and have been approved for use by the firm’s [insert details, e.g. Head of IT
department].
The firm’s procedures ensure that any updates to IT applications are processed on a timely
basis to ensure that they are kept up to date and do not expose the firm to unnecessary
data security risks or the possibility of using resources that are out of date.

Intellectual resources

As noted in [chapter 4 of this policy], the firm maintains a technical library designed to
ensure that partners and staff have access to the intellectual resources they require in
order to be able to perform engagements to the required standard.
As noted above, the firm uses [insert applicable details, e.g., a proprietary system] for our
audit methodology sourced by [insert name of service provider / own methodology / hybrid
approach]. Our assessment of the service provider is filed at [insert details of location].
All intellectual resources are reviewed [insert details, e.g., annually] to ensure that they
have been adequately maintained and are kept up to date.

Services providers

A service provider is an individual or organization external to the firm that provides a

resource that is used in the system of quality management or in the performance of
engagements. Service providers exclude the firm’s network, other network firms or other
structures or organizations in the network.
The firm utilizes a number of service providers as part of its system of quality management
and in the performance of engagements. This includes the following:
 Training organizations;
 External organizations providing audit quality reviews;
 Organizations providing technical support / consultation;
 Organizations that provide audit / assurance methodologies;
 Organizations that provide the software which houses the audit / assurance
methodologies;
 Organizations that provide technological resources that are directly uses in designing,
implementing or operating the firm’s system of quality management;
 Organizations that provide technological resources that are used directly by
engagement teams in the performance of engagements;
 An auditor’s external expert that assists the engagement team in providing audit
evidence; and
 Component auditors.
In addition to the obligations under HKSQM 1, the firm ensures that engagements are
performed in accordance with relevant HKSAs requirements applicable to service
providers, for example HKSA 600 in respect of component auditors and HKSA 620 in

Page 26 QMM Appendix 2

respect of the use of an auditor’s expert.
The firm acknowledges its responsibility for the system of quality management, and has in
place policies and procedures designed to ensure that the outsourcing of important
functions with the system of quality management to service providers is not undertaken in
such a way as to impair the firm’s internal quality management and the ability to monitor
the firm’s compliance with professional standards and applicable legal and regulatory
requirements.
The firm’s policies and procedures involve consideration of the nature of the resources
provided by the service providers, how and the extent to which they will be used by the firm
and the general characteristics of the service providers used by the firm in order to identify
and assess quality risks related to the use of such resources.
In determining whether a resource from a service provider is appropriate for use in the
firm’s system of quality management or in the performance of audit engagements the
following matters are considered:
 The related quality objectives and quality risks;
 The nature and scope of the resources, and the conditions of the service;
 The extent to which the resource is used across the firm, how the resource will be used
by the firm and whether it is suitable for that purpose;
 The extent of customization of the resource for the firm;
 The firm’s previous use of the service provider; and
 The service provider’s experience in the industry and reputation in the market.
 Service provider assessments are located at [Appendix 3].
Example questions to ask of service providers include the following:
Generic
 What is your complaints / allegations policy in relation to technical matters?
 Who oversees technical quality? Can you provide biographies?
Audit / assurance methodology
 What controls are in place to highlight where changes to products are required?
 What controls are in place to ensure that any required changes are appropriately
project managed from a timing and resource perspective?
 What controls are in place to ensure technical accuracy of the changes?
 Who performs / checks that the controls are designed and implemented?
 How are you happy that individuals performing / reviewing work have the appropriate
competencies and capabilities? Can you provide biographies for those individuals?
How do you ensure they are appropriately trained for the type of work they perform?
 Is your audit methodology mapped to HKSAs, the Code and other regulatory
requirements?
 Is your assurance methodology appropriately mapped to the relevant standards?
 If your methodology feeds into software providers, whose responsibility is it for the
technical accuracy within the software?
Software providers with audit / assurance methodology

Page 27 QMM Appendix 2

 How often is the software/program updated?
 What security features are included in the software (e.g., audit trail/access controls)
 What privacy/confidentiality features are included?
 What backup arrangements exist for the software?
Training
 Do you provide course descriptions of all of your courses?
 Do you provide course notes / slides? What controls are in place to ensure technical
accuracy of your course notes / slides?
 Who performs the training? Can you provide biographies of those providing the
training? How do you ensure that they have the appropriate competencies and
capabilities? How do you ensure they are appropriately trained for the type of work
they perform?
 Do you use any subcontractors? What controls are in place in relation to these?
 How do you assess technical quality in relation to trainers delivering courses? Do you
obtain feedback from your courses?
HR type service e.g., file reviews / technical consultancy
 How do you ensure those individuals performing the service have the appropriate
competencies and capabilities?
 Do you provide named individuals as to who will perform the service? Can you provide
biographies of those performing the services? How do you ensure they are
appropriately trained for the type of work they perform?
 Where professional qualifications are required, have these been independently
checked?
 How do you ensure independence is checked?
 How do you ensure technical accuracy of work performed?
 Do you use any subcontractors? Are the controls in place the same?

Page 28 QMM Appendix 2

8 INFORMATION AND COMMUNICATION

The firm routinely communicates the following to all engagement personnel:

 Individual’s responsibility for implementing the firm’s responses that form part of the
system of quality management;
 Changes to the system of quality management, to the extent that the changes are
relevant to their responsibilities and which enables personnel to take prompt and
appropriate action in accordance with their responsibilities; and
 Information that is obtained as part of the firm’s acceptance and continuance process
that is relevant to engagement teams in planning and performing engagements.
The means by which this information is communicated is determined by the firm, taking into
account the nature and extent of the communication required. For example, a minor update
to a policy will usually be communicated via email along with a copy of an updated policy
document. Communication of more significant changes may take the form of a training
course (whether online or face to face) or provision of a training manual.
Engagement teams are required to communicate the following matters to the [insert
details, e.g., the firm’s ethics partner; managing partner] applicable to the engagements:
 Information obtained during the course of an engagement about a client that may have 1.34(d)(i)
caused the firm to decline the client relationship or specific engagement had the
information been known prior to accepting or continuing the client relationship or
specific engagement;
 The firm is obligated by law or regulation to accept a client relationship or specific 1.34(d)(ii)
engagement;
 The operation of the firm’s responses which may indicate a deficiency in the firm’s
system of quality management. 1.34(e)(i)

Engagement teams are encouraged to initially communicate such information verbally to

the engagement partner and, where appropriate, follow this up with written communication.
Engagement teams are also required to communicate relevant information to the
engagement quality reviewer or any individuals providing consultation.
Group audit engagement teams are required to communicate matters to component
auditors in accordance with the firm’s policies and procedures, including matters related to
quality management at the engagement level.
Communication with Those Charged with Governance
 On [insert details, e.g., an annual] basis, the individual(s) with ultimate responsibility 1.34(e)(i)
and accountability for the firm’s system of quality management should communicate
with those charged with governance when performing an audit of financial statements
of listed entities about how the system of quality management supports the consistent
performance of quality audit engagements. The communication should be in writing
and the records are maintained at [insert details where these are located].
Communication with External Parties
Where appropriate, the firm communicates its information with external parties, including
service providers and the network to which the firm belongs.
The firm determines when it is appropriate to communicate with external parties about the 1.34(e)(ii)
firm’s system of quality management which is a matter of professional judgment. The
communication is influenced by:

Page 29 QMM Appendix 2

 The extent to which the firm has already communicated with external parties in
accordance with law or regulation.
 The expectations of stakeholders.
 The information that is already available to external parties.
 How external parties may use the information.
 [Insert details as appropriate. Further guidance is available in paragraph A130 of
HKSQM 1]
Information to be Provided When Communicating Externally
The following attributes are considered in preparing information that is communicated with
external parties: 1.34(e)(iii)
 The information is specific to the circumstances of the firm.
 The information is presented in a clear and understandable manner, and the manner of
presentation is neither misleading nor would inappropriately influence the users of the
communication.
 The information is accurate and complete in all material respects and does not contain
information that is misleading.
 The information takes into consideration the information needs of the users for whom it
is intended, such as the level of detail that users would find meaningful and whether
users have access to relevant information through other sources (e.g., the firm’s
website).
 [Insert details as appropriate. Further guidance is available in paragraph A131 of
HKSQM 1]].
The firm uses professional judgment in determining, in the circumstances, the appropriate
form of communication with the external party, including communication with those charged
with governance when performing an audit of financial statements of listed entities, which
may be made orally or in writing. Accordingly, the form of communication may vary. [Insert
details as appropriate. Further guidance is available in paragraph A132 of HKSQM 1].
Furthermore, we cooperate with external regulatory bodies when we are required by law,
regulation or professional standards to communicate with them, for example when:
 As part of a regulatory inspection of our audit work performed by our regulatory body;
 We become aware of an instance of non-compliance with law and regulation and we
required to report this to an appropriate authority outside the client entity;
 Law or regulation requires the firm to publish a transparency report and specifies the
nature of the information that is required to be included in the transparency report; and
 Securities law or regulation requires the firm to communicate certain matters to those
charged with governance.
When communicating with external parties, client confidentiality should be ensured and
maintained according to the policy set out in [chapter 4 of this policy], except where there is
legal or regulatory obligation on the firm to do otherwise. In such circumstances, only those
partners and staff within the firm with an appropriate level of authority are permitted to
communicate with the external parties concerned.
All communications are retained by the firm in accordance with its retention policy.

Page 30 QMM Appendix 2

9 THE MONITORING AND REMEDIATION OF THE SYSTEM OF
QUALITY MANAGEMENT

The firm’s policies and procedures include an ongoing consideration and evaluation of the 1.36 – 37
system of quality management, including a periodic inspection of a selection of completed
engagements. This monitoring process enables the firm to take appropriate action to
respond to any identified deficiencies and ensure that they are remediated on a timely
basis.
Specifically, the firm conducts monitoring by means of:
 Completed file review;
 Regulatory and/or network inspections;
 Complaints and allegations;
 Identified breaches of the firm’s system of quality management;
 Pronouncements made by regulatory bodies.
This policy also sets out the firm’s assessment of identifying deficiencies in the system of
quality management and implementing appropriate remedial action.

Completed file review

Completed engagements selected for compliance review include, as a minimum, at least 1.38(c)
one engagement for each engagement partner over a period that ordinarily spans no more
than [insert number of years, e.g., three years]. When selecting files for review, factors to
consider include:
 Profile and risks associated with the client, e.g., listed and regulatory entities; 1.37(a)
 Changes to professional standards relevant to the client;
 Changes to the firm’s system of quality management; 1.37(d)
 Complaints and allegations about failures to perform work in accordance with
professional standards and applicable legal and regulatory requirements or non-
1.37(f)
compliance with the firm’s QM policies or procedures;
 Information from external inspections and information from service providers;
1.37(f)
 Results of previous monitoring activities, including whether previous monitoring
activities continue to be relevant in evaluating the firm’s system of quality management
and whether remedial actions to address previously identified deficiencies were
effective 1.37(e)

 Results of other monitoring activities relevant to the engagements and engagement

partners. 1.38(b)
 [Insert details as appropriate]
Individuals performing the completed file review are assigned by [insert details, e.g., the
firm’s managing partner] to people who have sufficient and appropriate experience and
authority to assume that responsibility and who are not involved in the performance of the 1.39
engagement (including the role of EQ reviewer). This may include the use of external
service providers.
The results of completed file review are documented and recorded at [insert details of

Page 31 QMM Appendix 2

locations]. All the reviewers are required to report their review findings to [insert details,
e.g., individual(s) assigned operational responsibility for the monitoring and remediation
process], who should evaluate findings to determine whether deficiencies exist and take
remedial action set out in [this chapter]. 1.40

Regulatory and/or network inspections

The firm is subject to regular regulatory inspections by its regulatory body[, such as the
Accounting and Financial Reporting Council] that address the quality of its audit work.
These inspections address the firm’s compliance with relevant ethical, auditing and other
professional standards, resulting in engagements that meet the required quality expected.
These inspections will address similar issues to that considered by the firm’s completed file
review, and may identify deficiencies in the firm’ system of quality management that
previously had not been identified by the firm’s own monitoring procedures. The [insert
details, e.g., individual(s) assigned operational responsibility for the monitoring and 1.40
remediation process] should evaluate findings to determine whether deficiencies exist and
take remedial action set out in [chapter 10 of this policy].
[The firm is also subject to regular inspection by the network, and this review may identify
deficiencies in the firm’s system of quality management that had not previously been
identified by the firm’s own monitoring procedures.]

Complaints and allegations

The firm has the following policies and procedures (including clearly defined channels of 1.34(c)
communication without fear of reprisals) to provide it with reasonable assurance that it
deals appropriately with:
 Complaints and allegations that the work performed by the firm fails to comply with
professional standards and regulatory and legal requirements; and
 Allegations of non-compliance with the firm’s system of quality management.
On receipt of a complaint or allegation, which should usually be in writing, the investigation
of the matter is assigned to [insert details of the partner responsible for complaints and
allegations], who must be an individual with appropriate authority, competence, capabilities
(including sufficient time) to perform the role and does not involve in the complaint or
allegation.
The process should include an initial acknowledgement being sent to the complaint or
person raising the allegation, together with a commitment that the matter is being
investigated, and an explanation that a response will be provided after it has been
investigated. An estimated timescale for this response should be given, and the
complainant or person raising the allegation should be updated should this timescale need
to change (e.g., due to the complexity of the case).
As part of the investigation, the partner assigned should seek to identify the facts of the
case by conducting interviews and/or inspecting documents as appropriate. They should
determine whether a breach of laws, regulations, ethical requirements, professional
standards or firm policies and procedures has occurred, and if so, the significance and
consequences of this. In making this determination, consultation may be required with
other parties, including legal counsel (if authorized by the firm).
Once fully investigated, a report detailing the findings and any recommendations should be
prepared. The complaint or person who has raised the allegation should then be

Page 32 QMM Appendix 2

responded to.
Where recommendations have been made, these should be implemented.
Records will be kept of any complaints made in writing about the performance of the
engagements carried out.
If, during the investigations into complaints and allegations, deficiencies in the design or
operation of the firm’s quality management policies and procedures or non-compliance with
the firm’s system of quality management by an individual or individuals are identified, the
[insert details, e.g., individual(s) assigned operational responsibility for the monitoring and
remediation process] should evaluate findings and take remedial action set out in [this
chapter]. 1.40

Reported breaches of the firm’s system of quality management

As noted in [chapter 8 of this policy], all personnel in the firm are required to communicate
information on the operation of the firm’s responses which may indicate a deficiency in the
firm’s system of quality management. This could, for example, include concerns about the
firm’s processes for assigning personnel to engagements, or a breach of the ethical
standard that has arisen.
The firm maintains records of all breaches of professional standards and applicable legal
and regulatory requirements that have been identified/reported, except where the firm
reasonably considers them to be minor breaches. The firm also keeps records of the
consequences of any breach that has been recorded, the measures taken to address such
a breach and to modify the firm’s internal quality management system. These records are
maintained by the [insert details, e.g., individual(s) assigned operational responsibility for 1.40
the monitoring and remediation process] who take remedial action set out in [this chapter].

Pronouncements made by regulatory bodies

[Insert names of relevant bodies, e.g., The HKICPA; Accounting and Financial Reporting
Council] regularly publishes information which can be of use in highlighting ways in which
the firm’s system of quality management can be improved upon. This includes:
 The results of disciplinary action taken involving audit work performed by other firms;
 Summarized information on findings of regulatory monitoring visits made; and
 Other technical guidance.
This information is considered to highlight potential changes to the firm’s system of quality
management that may be necessary.

Deficiencies in the system of quality management

Findings from the procedures stated in this chapter are evaluated by [insert details, e.g., 1.40
individual(s) assigned operational responsibility for the monitoring and remediation
process] to determine whether deficiencies exist.
Effect of deficiencies noted are evaluated as a result of the monitoring process and
whether they are:
 Instances that do not necessarily indicate that the firm’s system of quality management

Page 33 QMM Appendix 2

 is insufficient to provide it with reasonable assurance that it complies with professional
standards and regulatory and legal requirements, and that the reports issued by the
firm or engagement partners are appropriate in the circumstances; or
 Systematic, repetitive or other significant deficiencies that require prompt corrective
action.
In evaluating the severity and pervasiveness of identified deficiencies our policies and
procedures involve:
 Investigating the root cause(s) of the identified deficiencies; and
 Evaluating the effect of identified deficiencies, individually and in aggregate, on the
1.41(a)
system of quality management.
1.41(b)
A checklist for use when performing the root cause analysis is at [Appendix 11].
In determining the nature, timing and extent of the procedures to investigate the root
cause(s), the firm takes into account the nature of the identified deficiencies and their
possible severity.

Remedial action

The firm designs and implements remedial actions to address identified deficiencies that 1.42
are responsive to the results of the root cause analysis.
The firm’s evaluation of each type of deficiency results in recommendations for one or
more of the following:
 Taking appropriate remedial action in relation to an individual engagement or member
of personnel;
 The communication of the findings to those responsible for training and professional
development;
 Changes to the quality management policies and procedures; and
 Disciplinary action against those who fail to comply with the policies and procedures of
the firm, especially those who do so repeatedly.
 [Insert details as appropriate]
Responding to Identified Deficiencies
The individual(s) assigned operational responsibility for the monitoring and remediation
process should evaluate whether:
 Any proposed remedial actions are appropriately designed to address the identified 1.43(a)
deficiencies and their related root cause(s);
 Remedial actions have been implemented; and 1.43(b)
 Past remedial actions have been effective to address previously identified deficiencies. 1.44
Should the evaluation indicate that remedial actions are not appropriately designed and
implemented or are not effective, the individual(s) assigned operational responsibility for
the monitoring and remediation process is required to take appropriate action until they are
satisfied that the remedial actions have been sufficiently modified such that they are
effective.
Findings About a Particular Engagement
Where the results of the monitoring procedures indicate that a report issued may be

Page 34 QMM Appendix 2

inappropriate or that procedures were omitted during the performance of the engagement,
[insert details, e.g., individual(s) assigned operational responsibility for the monitoring and
remediation process] determine what further action is appropriate to comply with relevant
professional standards and regulatory and legal requirements, for example, obtaining legal 1.45
advice.
Ongoing Communication Related to Monitoring and Remediation
The individual(s) assigned operational responsibility for the monitoring and remediation
process communicate [insert frequency, e.g., monthly; quarterly] the results of the
monitoring of the firm’s quality management to:
 The individual(s) assigned ultimate responsibility and accountability for the firm’s 1.46
system of quality management; and
 The individual(s) assigned operational responsibility for the system of quality
management.
Such communication enables both the firm and these individuals to take prompt and
appropriate action where necessary in accordance with their defined roles and
responsibilities. Information communicated includes the following:
 A description of the monitoring procedures performed;
 The identified deficiencies, including the severity and pervasiveness of such
deficiencies; and
 The remedial actions taken to address the identified deficiencies.
 [Insert details as appropriate]
The above communication is made [in writing] and records of the communication are
maintained at [insert locations].
These issues are also communicated to engagement teams and other individuals assigned
activities within the system of quality management to enable them to take prompt and
appropriate action in accordance with their responsibilities. The information is circulated
[insert frequency, e.g., monthly; quarterly] records of the communication are maintained at
[insert locations].
1.47
[For firms which operate as part of a network: All the firms within our network operate
under common monitoring policies and procedures designed to comply with this standard.
Therefore, the firm’s policies and procedures require that:
 At least annually, the network communicates the overall scope, extent and results of
the monitoring process to appropriate individuals within the network firms; and
 The network communicates promptly any identified deficiencies in the system of quality
management to appropriate individuals within the relevant network firm or firms so that
the necessary action can be taken,
In order that engagement partners in the network firms can rely on the results of the
monitoring process implemented within the network (unless the firms or the network advise
otherwise).]

10 EVALUATING THE SYSTEM OF QUALITY MANAGEMENT

On an annual basis, the individual(s) assigned ultimate responsibility and accountability

for the system of quality management shall evaluate, on behalf of the firm, the system of
quality management, assisted by others as necessary. This evaluation will be informed by

Page 35 QMM Appendix 2

 the monitoring and remediation process, as communication by the individual(s) assigned
operational responsibility for the monitoring and remediation process (see [chapter 9 of
this policy]).
The evaluation shall reach one of the following conclusions:
a) The system of quality management provides the firm with reasonable assurance that
the objectives of the system of quality management are being achieved;
b) Except for matters related to identified deficiencies that have a sever but not pervasive
effect on the design, implementation and operation of the system of quality
management, the system of quality management provides the firm with reasonable
assurance that the objectives of the system of quality management are being
achieved; or
c) The system of quality management does not provide the firm with reasonable
assurance that the objectives of the system of quality management are being
achieved.
A declaration to document this evaluation is at [Appendix 12].
Where the conclusion is either (b) or (c) the firm’s policies and procedures require prompt
and appropriate action and updates, and communicate appropriately to audit teams and
other individuals assigned activities within the system of quality management to the extent
that it is relevant to their responsibilities, and any other relevant external parties.

Page 36 QMM Appendix 2