The Quality Management Shift: What Caribbean Audit Committees Must Know About ISQM 1 and ISQM 2

Audit committees have spent years learning to evaluate audits. The standards on what a competent audit must do — ISA 315 (Revised), ISA 330, ISA 600 (Revised) — are now reasonably well understood at the board level. But there is a second, quieter set of standards that audit committees across the Caribbean have not yet fully internalised, and which now sits at the centre of audit quality regulation worldwide: the International Standards on Quality Management — ISQM 1 and ISQM 2.

These standards do not govern what an auditor does on your audit. They govern what kind of firm is doing the audit at all.

The distinction matters. A firm can deliver a high-quality audit on a single engagement by sheer effort and seniority, and still fail the quality management regime applied to the firm itself. Increasingly, regulators, audit committees, and lenders are asking — and are entitled to ask — what kind of firm-level system stands behind the partner who signs the opinion. ISQM 1 and 2 are how the profession answers that question.

What Changed, and Why

ISQM 1 replaced ISQC 1 — the previous firm-wide quality control standard — for systems required to be designed and implemented by 15 December 2022. ISQM 2 — Engagement Quality Reviews — became effective for audits beginning on or after the same date. Together, they represent the most significant change to the architecture of audit firm quality in two decades.

The reasons for the change were not subtle. Inspections by audit regulators worldwide — the PCAOB in the United States, the FRC in the United Kingdom, the Canadian Public Accountability Board, and counterparts elsewhere — had revealed a consistent pattern: firms had quality control policies, but the policies did not necessarily translate into quality outcomes. The procedures existed; the engagements still failed inspection. The IAASB concluded that quality control needed to become quality management — a shift from compliance with procedures to ownership of risks.

ISQM 1 is built around a simple but demanding idea: every firm must design its quality management system around its own specific quality risks, and must be able to evidence, in writing, that the system addresses those risks. The standard is risk-based, scalable to the size of the firm, and explicitly places accountability with firm leadership.

“ISQM 1 is built around a simple but demanding idea: every firm must design its quality management system around its own specific quality risks.”

The Eight Components of ISQM 1

ISQM 1 organises a firm’s quality management system around eight components. They are worth understanding at a board level because each is something an audit committee can — and increasingly should — ask about:

• Governance and leadership. The firm must establish clear leadership accountability for quality. In practice, this means a named individual (or individuals) is responsible, with the authority to act and the resources to deliver.
• Relevant ethical requirements. The firm must have a system that addresses independence threats, ethical compliance, and the IESBA Code requirements at both firm and engagement level.
• Acceptance and continuance of client relationships and specific engagements. The firm must have a documented process for deciding which engagements to accept and which to decline — and must be able to evidence why each decision was made.
• Engagement performance. The firm must direct, supervise, and review engagement work, including consultation processes for complex or contentious matters and the differences-of-opinion procedure when partners disagree.
• The firm must ensure it has the human, technological, intellectual, and service-provider resources to deliver engagements competently — and must replenish those resources over time.
• Information and communication. The firm must have systems that allow information about quality to flow within the firm and, where required, to external parties.
• Monitoring and remediation. The firm must monitor whether its system is operating as designed, identify deficiencies, evaluate root causes, and take corrective action.
• Network requirements and services. Where the firm belongs to a network or uses network services, those interactions must themselves be governed under the quality management framework.

Each component is supported by specific quality objectives, risks the firm must identify, and responses the firm must design. The system is, deliberately, a system — not a checklist.

ISQM 2 — Engagement Quality Reviews

ISQM 2 governs the engagement quality review (EQR) — what was historically called the engagement quality control review or the concurring partner review. In substance, it requires that for certain engagements — including audits of listed entities, audits the firm has determined to be EQR-required, and audits required by law or regulation to have an EQR — a second, sufficiently experienced, and independent reviewer evaluates the significant judgments made by the engagement team and the conclusions reached, before the engagement report is dated.

ISQM 2 sharpens the eligibility criteria for the EQR (independence from the engagement, competence, time and authority to act), the documentation requirements, and the conditions under which the review must occur. The intent is straightforward: a second pair of senior eyes, with the authority to require changes before sign-off, materially reduces the risk that a flawed engagement reaches issuance.

For audit committees, the existence and conduct of the EQR is a legitimate and important question. Audits at the larger end of the Caribbean market should, in almost all cases, be subject to an EQR — and the audit committee chair is entitled to know who the reviewer is, what their experience is, and how their independence from the engagement is maintained.

Why This Should Matter to Caribbean Audit Committees

Three reasons make ISQM 1 and 2 a legitimate audit committee concern in the Caribbean, even though they are technically firm-level standards.

First, regulator alignment. The Bank of Jamaica, the Financial Services Commission of Jamaica, the Eastern Caribbean Central Bank, the Cayman Islands Monetary Authority, the Financial Services Regulatory Commission, and other Caribbean supervisors are moving — at varying paces — toward asking auditors about their ISQM 1 systems during inspection and supervisory dialogue. A regulated entity whose auditor is weak on ISQM 1 is, increasingly, exposed to questions the entity’s board did not anticipate.

Second, root cause discipline. The most demanding component of ISQM 1 is the requirement that, when a quality deficiency is identified, the firm must conduct a root cause analysis and address the cause — not merely the symptom. This is the same intellectual discipline that audit committees themselves have been applying to internal control deficiencies for years. A firm that does this well on its own quality issues is likely to do it well on yours.

Third, signal of seriousness. Implementation of ISQM 1 is non-trivial. A small or thinly resourced firm can issue audit opinions, but cannot easily build a defensible quality management system. The presence of a substantive ISQM 1 system is, in itself, a signal that a firm has invested in its own future as a serious audit institution.

“The presence of a substantive ISQM 1 system is, in itself, a signal that a firm has invested in its own future as a serious audit institution.”

Five Questions the Audit Committee Should Ask the Firm

In the next audit planning meeting — or in the next proposal evaluation — these five questions reach the heart of an auditor’s ISQM 1 and 2 posture:

• Who in your firm is accountable for the quality management system, and what authority do they hold? The named individual matters. A firm without a clearly accountable leader on quality has not internalised the standard.
• How does your acceptance and continuance process work for an engagement of this profile, and what would cause you to decline us as a client? A firm that cannot articulate the circumstances under which it would decline is a firm that has commoditised acceptance.
• Will this engagement be subject to an engagement quality review under ISQM 2? If so, who is the reviewer, what is their experience, and how is their independence from the engagement team maintained? These are answerable questions and a competent firm answers them readily.
• How did your most recent monitoring cycle assess the firm’s quality, and what — if any — significant deficiencies were identified? You are not asking to read the file. You are asking whether the firm can articulate, at a leadership level, where it is investing in its own improvement.
• If the engagement team and the engagement quality reviewer reach a difference of opinion on a significant matter, how is that resolved, and who decides? This question reveals whether the firm has a real differences-of-opinion process or a politely-worded one.

How Dawgen Global Operationalises ISQM 1 and 2

Within D·ASSURE™, ISQM compliance lives across two pillars: the A pillar (Acceptance and Independence) and the E pillar (Engagement Quality). Together, these two pillars carry the firm-level commitments that make individual audit engagements deliverable to a consistent standard.

Dawgen Global maintains a documented quality management system aligned with ISQM 1, with named leadership accountability at the partner level, a documented client acceptance and continuance framework, a monitoring and remediation cycle, and a root cause analysis discipline applied to any identified deficiency. Engagement quality reviews under ISQM 2 are conducted for audits of public interest entities, regulated financial institutions, group audits above defined thresholds, and other engagements the firm’s risk assessment identifies as warranting EQR. The Jamaica Assurance Team standard — our designated engagement leadership designation — operates within this quality framework, not parallel to it.

These investments are not visible to the casual observer. They are visible to regulators, to audit committees that know to ask, and — eventually — to the audit committees that learn the hard way that they should have.

What’s Next in the Series

Article 4 examines what an audit looks like when the underlying entity is digitised — when journal entries are posted by integrated ERPs, when revenue is recognised by software, and when the auditor’s role shifts from sampling transactions to interrogating populations. If ISA 315 (Revised) defines how risk should be identified and ISQM 1 and 2 define what kind of firm should be doing the identifying, Article 4 takes up what the work itself now looks like in a digitised Caribbean economy.

If you are an audit committee chair or CFO and would like a confidential briefing on what to expect from an ISQM 1 and 2 compliant audit firm — or a benchmarking review of your current auditor’s quality management posture — the Dawgen Global Audit & Assurance team welcomes the conversation. Write to [email protected] or visit dawgen.global.

About the Author

Dr. Dawkins Brown is the Executive Chairman and Founder of Dawgen Global, an independent, integrated multidisciplinary professional services firm headquartered in New Kingston, Jamaica, with operations across more than fifteen Caribbean territories. He writes weekly on Caribbean governance, audit, and assurance matters through Caribbean Boardroom Perspectives and The Caribbean Advisory Brief.

The Caribbean Audit Imperative

A twelve-article series from Dawgen Global  |  dawgen.global

About Dawgen Global