Navigating CSQM 1: Monitoring and Remediation Process, Strengthening Performance

Kirsten S. Albo, FCPA, FCA, ICD.D is the founder of ASK KSA Consulting Inc., which helps SMPs save time and achieve peace of mind through consulting and advisory services related to conducting effective and efficient engagements and meeting the requirements of being in public practice. She has worked closely with over 200 firms in helping them meet the requirements of CSQM 1.

CANADIAN Standards on Quality Management (CSQM 1) is the overarching standard that requires your accounting firm to design, implement and operate a system of quality management (SQM). The objectives of the SQM are to ensure the firm and its personnel understand and fulfill their professional responsibilities and that the appropriate engagement report is issued. 

CSQM 1 has two processes, the risk assessment process and the monitoring and remediation process. The first article in this two-part series focused on the risk assessment process itself and how properly identifying and assessing risk provides value throughout both processes. 

Once a system of quality management is designed, implemented and operated, it must be monitored to ensure it is working. This article explores the monitoring and remediation process and its significance in strengthening overall quality in your firm which in turn leads to conducting effective and efficient engagements. 

Before we dive into monitoring, let's briefly remind ourselves of the risk assessment process. This process was about identifying and assessing quality risks based on the nature and circumstances of the firm and the engagement it performs. Focusing on the risks of the firm then allowed the firm to be efficient in linking risks to quality objectives and developing tailored risk responses. It is important to remind ourselves of key activities during this phase to be efficient in the next. 

The critical groundwork of focusing on risks sets the stage for the monitoring and remediation process. The first step is determining the right monitoring activities to be performed. 

Monitoring Activities 

The objective of monitoring is to ensure your system of quality management is working. The question that I most often hear on this topic is, what actually needs to be done? The answer once again focuses on risk. Where are the higher-risk areas you identified in your firm? That is what needs to be monitored. 

CSQM 1 does not prescribe any specific monitoring activities, other than cyclical file inspections. This grants a firm the flexibility to tailor monitoring activities according to its unique circumstances. While this initial development might require initial effort, it's an investment well worth the time.

In developing your monitoring activities, link back to the risks identified in the risk assessment process. 

For example, I expect many firms identified intellectual resources as a higher-risk area due to changing standards and the requirement to update engagement templates. This risk is elevated even further for those firms who create their own templates. Monitoring activities should focus on ensuring templates have been updated on a timely basis in accordance with the firm’s policies and procedures. Further, monitoring activities should also focus on communication with engagement teams when updates have been made. That is, were engagement teams made aware of the necessity to update their engagement files? 

Another higher-risk area that is often identified is engagement performance, specifically partner involvement, review and supervision and documentation. An efficient way to monitor engagement performance compliance is through cyclical file inspections. 

Cyclical File Inspections 

Cyclical file inspections are often viewed as another necessary evil. They have to be done, however, a change in mindset helps a firm recognize they can be beneficial. When file inspections are conducted in a constructive and insightful manner and on a timely basis, firms can derive valuable information to be applied in future engagements. 

As can be inferred by its name, file inspections are required on a cyclical basis. The firm decides on the “standard period” for each type of engagement. The standard period is the starting point for how often they should be conducted. Linking back to risks, there may be other factors that come into play when selecting files for inspection. Such considerations may include the results of previous inspections, the type of engagement and the experience of the partner. For example, if a partner has had poor results in the past or is a new partner, the firm may elect to perform cyclical file inspections on a more frequent basis. 

I encourage you to think of the cyclical file inspection as an opportunity. It has to be done so why not make it worthwhile versus just a “check the box exercise”. You want to know where deficiencies lie so you can fix them and strengthen quality. If there is a deficiency, better to know now and remediate rather than finding out when it is too late. No one expects to end up in court, but it happens. 

And, cyclical file inspections can be an opportunity to identify efficiencies in your files. For example, perhaps if a robust response is documented on one working paper, another working paper is not needed. It is not only about doing the right work, it is also about doing the right amount of work. 

Remediating 

The true power of monitoring lies in the remediation process. This step is taking action to correct deficiencies and make meaningful improvements. The process starts with the right attitude. Think about findings not as a failure but rather as an indicator of where improvement is needed. It's akin to discovering a problem with your car; you don't ignore it but rather take steps to fix it. No different with deficiencies, when they are discovered, they are fixed. This continuous commitment to quality strengthens performance. 

The standard requires a root cause analysis of the cause of the deficiency. This does not have to be a complicated exercise but rather a reflection as to what happened and why. You most likely will have to ask “why” a few times to get to the real root cause but the benefit of doing so is you then arrive at a clear actionable item. 

When remedial actions are implemented, it is important they are responsive to the root cause of why the deficiency occurred. For example, suppose monitoring identified engagement templates were not updated in a timely manner and the root cause was determined to be engagement teams were not aware of updates being available. Remediation activities most likely would include both short-term activities, sending out immediate communication to teams and long-term activities, revising your communication process when updates are needed. The key is that action has been taken to strengthen performance at the firm. 

Conclusion and Next Steps 

Many accounting firms view monitoring and its related activities as a mundane task. However, when we shift our perspective, we realize that monitoring can be a valuable exercise to strengthen the firm, not only from a quality perspective but a business perspective as well. 

I believe firms should view the monitoring and remediation process as an opportunity. Through the development of tailored monitoring activities focused on risk, the embrace of findings as opportunities for improvement, and the commitment to remediation, firms create a robust system of quality management. This, in turn, leads to conducting more effective and efficient engagements. 

Remember, it's not just about ticking boxes; it's about shaping the future of your firm and the quality of service you deliver. 

Kirsten S. Albo, FCPA, FCA, ICD.D is the founder of ASK KSA Consulting Inc., which helps SMPs save time and achieve peace of mind through consulting and advisory services related to conducting effective and efficient engagements and meeting the requirements of being in public practice. She has worked closely with over 200 firms in helping them meet the requirements of CSQM 1.