Key Aspects of Risk-Oriented Approach to Quality Management System in an Audit Firm

Abstract

The implementation of new International Standards on Quality Management has posed a challenge for auditing firms, as it has necessitated a transition from "quality control" to "quality management" and the updating of internal quality management systems. Consequently, investigating key aspects of a risk-oriented approach to the quality management system of an auditing firm is extremely relevant. The risk-oriented approach focuses on identifying, assessing, and managing risks that affect the quality of auditing services. This approach is based on three interconnected elements: setting quality objectives, identifying quality risks, and implementing actions in response to quality risks. The risk-oriented approach enables auditing firms to identify and address potential issues to ensure better quality of auditing services. Firms concentrate their efforts on the most significant risks, effectively utilizing time and resources. Since a clear understanding of the risks affecting auditing activities is essential, risk identification serves as the foundation for establishing quality objectives and corresponding actions in response. Classification of quality objectives by functional purpose may include objectives related to management and development, ethics and integrity, personnel, resources, processes, outcomes, information, and societal objectives. Defining objectives requires selecting appropriate measurable indicators of goal achievement and regularly monitoring and evaluating progress toward these objectives. We believe that the list of quality risks should include risks associated with non-compliance of auditing services with high quality standards, risks related to the low efficiency of firm operations, client loss, inability to develop and improve the firm, risks associated with breaches of ethical principles and norms of professional conduct. Risks can be transformed into incentives for development and achieving competitive advantages. Actions in response should be proportionate to the risk and based on the results of its assessment. Response actions can be preventive, aimed at preventing the risk from occurring, and corrective, aimed at correcting the situation after the risk has occurred. The effectiveness of response actions should be constantly monitored and reviewed as necessary. Quality objectives serve as the basis for risk identification. Risk assessment helps understand the probability and impact of risks, enabling informed decisions on which response actions to take.