ISQM 1 UK Audit Quality: ISQM 2 Explained

ISQM 1 UK audit quality requirements are built around a firm-wide system of quality management, not a static folder of policies. ISQM (UK) 1 asks firms to identify quality risks, design proportionate responses, monitor whether those responses work and remediate deficiencies. ISQM (UK) 2 complements it by setting requirements for engagement quality reviews. Together, the standards changed how UK firms demonstrate that audit quality is led, managed and improved. For the wider regulatory context, see Aureliant Global's Regulatory Compliance and Financial Services Advisory for UK Firms.

Request a Consultation

What are ISQM 1 and ISQM 2?

ISQM (UK) 1 is the firm-level standard for quality management. It applies to firms that perform audits or reviews of financial statements, or other assurance or related services engagements. ISQM (UK) 2 is the separate standard for engagement quality reviews, including the appointment, eligibility, responsibilities and documentation of the engagement quality reviewer.

The Financial Reporting Council's current pages for ISQM (UK) 1 and ISQM (UK) 2 show editions issued in July 2021 and updated in September 2025. The standards apply for audits and reviews of financial statements, and other assurance or related services engagements, for periods beginning on or after 15 December 2022.

ISQM 1 and ISQM 2 in one view

Standard

Main focus

What a firm must be able to demonstrate

ISQM (UK) 1

Firm-level quality management

Quality objectives, risk assessment, responses, monitoring, remediation and annual evaluation

ISQM (UK) 2

Engagement quality reviews

Appropriate reviewer eligibility, objective evaluation, timely performance and documented completion

ISA 220 (Revised)

Quality management at engagement level

Engagement partner and team responsibilities for quality on the individual audit

ISQM 1 does not replace the professional judgement of the engagement team, and ISQM 2 does not turn an engagement quality review into a second audit opinion. The standards operate together with the applicable auditing, ethical and legal requirements.

Why did ISQM 1 replace ISQC 1?

ISQM 1 replaced ISQC (UK) 1 because the earlier quality control model was not sufficiently focused on the specific risks and circumstances of each firm. The new model moves from a mainly compliance-based set of policies towards proactive quality management. The change is explained in ICAEW's overview of the quality management standards.

From policies to a risk-based system

• Firm-specific: quality risks must reflect the firm's structure, clients, engagements, people, technology and service providers.
• Preventive: the firm identifies how quality could fail before a deficiency appears.
• Responsive: the firm designs responses that address identified risks rather than relying on generic procedures.
• Iterative: monitoring, root cause analysis and remediation feed changes back into the system.
• Documented: the firm must retain enough evidence to support its judgements, actions and evaluation.

The practical consequence is significant. A policy that says a review will occur is not, by itself, evidence that the response is suitably designed, performed on time, monitored and improved when it does not work.

What are the eight components of an ISQM 1 quality management system?

An ISQM 1 system of quality management contains eight connected components. Six establish quality objectives and related responses, while the risk assessment process and monitoring and remediation process operate across the system. The components should be tailored to the nature and circumstances of the firm, including a small or specialist UK practice.

1. Governance and leadership

Leadership is responsible and accountable for quality. The firm's governance must give quality priority over commercial pressures, clarify responsibilities and provide enough authority and resources for the system to operate.

2. Relevant ethical requirements

The system must support compliance with relevant ethical requirements, including independence, objectivity, integrity and confidentiality. Firms need processes that identify threats, apply safeguards and retain evidence of the decisions reached.

3. Acceptance and continuance

Before accepting or continuing a client or engagement, the firm should assess whether it has the competence, capacity, time, information and ethical basis to perform the work. Commercial opportunity cannot replace a documented quality assessment.

4. Engagement performance

Engagement teams need direction, supervision and review appropriate to the engagement. This component covers consultation, differences of opinion, documentation, completion and the responsibilities that support a consistent quality outcome.

5. Resources

Resources include people, technological resources, intellectual resources and other resources used in the work. A firm should consider whether its teams have the competence, time, tools, methodology and access to specialists required for the engagements it accepts.

6. Information and communication

Relevant information must move to the people who need it, internally and, where appropriate, externally. This includes communicating responsibilities, changes in methodology, ethical matters, monitoring findings and information needed by engagement teams.

7. Risk assessment process

The risk assessment process is the engine of ISQM 1. A firm establishes quality objectives, identifies and assesses quality risks, then designs and implements responses. The process should be revisited when the firm's clients, services, people, technology or operating model change.

8. Monitoring and remediation

Monitoring tests whether the system is designed, implemented and operating effectively. When findings indicate a deficiency, the firm evaluates the severity, performs root cause analysis, designs remediation and checks whether the response has worked. Recording a finding without addressing its cause is not a complete quality-management response.

Explore Regulatory Compliance Advisory

What does ISQM 2 mean for engagement quality reviews?

ISQM 2 establishes a more explicit framework for the engagement quality review, or EQR. The review is an objective evaluation of significant judgements and conclusions reached by the engagement team. It must be completed before the engagement report is dated, and the reviewer must have the competence, capability, authority and time to perform the work objectively.

Which engagements require an EQR?

ISQM 2 applies to engagements where an EQR is required by law or regulation, audits of listed entities and other engagements for which the firm determines that an EQR is an appropriate response to one or more quality risks. That last category matters for smaller and non-listed firms. A firm should not treat the absence of a listed-entity requirement as proof that an EQR is never relevant.

• Consider the nature and circumstances of the engagement.
• Assess whether identified quality risks justify an EQR.
• Check the reviewer's eligibility, competence, authority and independence.
• Address differences of opinion before the report is dated.
• Document the review and its completion in sufficient detail.

The engagement quality reviewer is not the engagement partner, and the review is not a substitute for the engagement partner's responsibility. Firms may use an appropriately qualified reviewer from outside the firm or network where the standard and ethical requirements permit it.

What does ISQM 1 mean for small and medium UK audit firms?

ISQM 1 is scalable, but it is not optional for a smaller firm within its scope. A smaller practice does not need the same volume of policies, roles or monitoring activity as a large multi-office firm. It does need a system that reflects its risks, is understood by its people and produces evidence that the system is operating.

A proportionate implementation approach

1. Map the firm's services and engagements. Identify the types of work performed, the people responsible and the external resources used.
2. Set quality objectives. Use the eight components as the structure, then define what good quality requires in the firm's circumstances.
3. Identify quality risks. Consider where the firm's actual model could prevent objectives being achieved, including capacity, specialist knowledge, independence and technology.
4. Document responses and owners. Assign responsibility, timing and evidence requirements to each material response.
5. Monitor and remediate. Test responses, investigate deficiencies, perform root cause analysis and track corrective action.
6. Complete the annual evaluation. Bring the evidence together, reach the required conclusion and document the judgement.

For a small firm, proportionate monitoring might include review of selected completed engagements, checks on continuing professional development, independence confirmations and follow-up of previously identified deficiencies. The appropriate design depends on the firm's own risk assessment.

How does ICAEW monitor ISQM compliance?

ICAEW's quality assurance activity focuses on whether firms have implemented and evaluated their system of quality management, not merely whether they possess a policy manual. ICAEW guidance states that firms should perform the first evaluation by 15 December 2023 and further evaluations at least annually. Reviewers expect to see the documented conclusion and the monitoring evidence supporting it.

In its ISQM 1 quality assurance monitoring update, ICAEW describes monitoring that may include completed-engagement reviews, training and appraisal checks, ethical-compliance checks and review of remediation actions. Findings should be assessed for deficiencies, followed by root cause analysis and remediation where required.

The practical lesson for a UK firm is that annual evaluation is an evidence exercise. It should show what was monitored, what was found, how findings were assessed, what action was taken and whether that action addressed the underlying cause.

How can a company choose an audit firm that is genuinely ISQM-aligned?

ISQM alignment should be tested through specific questions rather than accepted as a badge or broad marketing statement. Audit committees, boards and CFOs can ask a prospective firm how its system operates in practice and how the firm knows that its responses are effective.

• Who is accountable for the system of quality management?
• How does the firm identify and update quality risks for its client base?
• How are independence, acceptance and continuance decisions documented?
• How does the firm assess whether an EQR is needed for this engagement?
• How are engagement quality reviewers selected, supported and kept objective?
• What monitoring activities are performed, and how are findings escalated?
• How does the firm perform root cause analysis and confirm that remediation works?
• Can the firm explain how its resources, technology and specialists support the engagement?

Aureliant Global positions itself as an ICAEW-regulated chartered accountancy firm with ISQM 1 and ISQM 2 alignment, ISA (UK) compliant methods and partner-led delivery. Its quality and risk management overview provides the appropriate starting point for understanding the firm's public quality positioning. A prospective client should still ask for engagement-specific explanations and evidence during the selection process.

Book a call with Aureliant Global

Frequently asked questions about ISQM 1 and ISQM 2

What is the difference between ISQM 1 and ISQM 2?

ISQM 1 governs the firm's system of quality management, including quality objectives, risk assessment, responses, monitoring and remediation. ISQM 2 governs engagement quality reviews, including reviewer eligibility, the reviewer's responsibilities and documentation.

Does ISQM 1 apply to small audit firms?

Yes, where the firm performs engagements within the standard's scope. The system should be proportionate to the firm's nature and circumstances, but a small practice still needs a firm-specific risk assessment, appropriate responses, monitoring, remediation and evaluation.

When did ISQM 1 become effective in the UK?

The standards apply for audits and reviews of financial statements, and other assurance or related services engagements, for periods beginning on or after 15 December 2022. Firms were also required to design and implement their system of quality management by that date.

What is an engagement quality review?

An engagement quality review is an objective evaluation of significant judgements and conclusions made by the engagement team. It is performed by an eligible reviewer and must be completed before the engagement report is dated when an EQR is required.

How often must a firm evaluate its system of quality management?

A firm must perform an evaluation at least annually. The conclusion should be supported by the monitoring work performed, the deficiencies identified, the remediation undertaken and the firm's documented judgement about whether quality objectives are being achieved.