DRAFT - Hong Kong Institute of Certified Public …

1 (I) Part B Sample policies for sole practitioner with no staff Relevant sections in 2006 edition Relevant standards Key updates in 2013 edition 1 Managing professional risk (Monitoring compliance) HKSQC The concept of monitoring quality control is clarified. Monitoring process comprises of two parts, yearly evaluation of the firm's compliance with its quality control policies and procedures, and cyclical inspection of completed files Two roles (completed file monitor and ongoing policy monitor) are introduced as follows: APPOINTMENT OF MONITORS I shall appoint a suitably qualified person(s) with the necessary competence, capabilities and time available to be: a) The CFM = Completed File Monitor (cyclical file inspections); b) The OPM = Ongoing Policy Monitor; or c) Both the CFM and the OPM (both roles performed by the same person).

2 A person appointed as CFM may not perform an inspection of a completed file in which he/she had any involvement performing the engagement or the engagement quality control review. The following new policy and procedure is added: RESULTS OF MONITORING PROCESS The monitor(s) shall document the results of the monitoring process and report any deficiencies noted on a timely basis (at least annually) to me. In preparing his/her report, the monitor(s) shall evaluate the effect of the deficiencies and determine whether they are: a) Serious Matters that require immediate corrective action by the sole practitioner to determine what further action (including legal advice) is appropriate to comply with relevant professional standards and applicable legal and regulatory requirements.

3 Examples include omission of required procedures, non-compliance with ethical requirements and the issuing of an engagement report that was inappropriate in the circumstances; b) Systemic, repetitive or otherwise significant Matters that require prompt corrective action such as additional staff training and changes in the Firm s policies and procedures; c) Isolated Matters that require consideration but do not indicate that the Firm's system of quality control is deficient or that the engagement reports issued are inappropriate. The monitor(s) shall also recommend what actions are required to resolve these deficiencies. 2 Independence and ethics (Independence/Conflict of interest) HKSQC - CODE The following new policy and procedure is added: REPORTING INDEPENDENCE BREACHES/IMPAIRMENTS AND CONFLICTS OF INTEREST I shall take appropriate action with regard to any new circumstances or information obtained during the engagement that could impair my independence.

4 If I identify a potential or actual impairment or DRAFT 2 conflict on an engagement already in progress, I shall take the appropriate action. This would include: a) Stopping work on any engagement in process until the implications of the new information can be assessed; b) Documenting the following: i. Nature of the engagement and the information received; ii. Results of any consultations with others and the conclusions reached; iii. Description of any threats identified and an explanation for the safeguard or safeguards identified and applied to eliminate the threat or reduce it to an acceptable level; c) Advising the client about the conflict of interest or independence prohibition and/or threat; and d) Implementing the agreed-upon action steps (such as independence safeguards or withdrawing from the engagement) as required.

5 3 The firm environment (Setting the tone) HKSQC - The following new policy and procedure is added: LEADERSHIP RESPONSIBILITIES Each person assigned an operational responsibility for the Firm s system of quality control ( , myself plus external leaders) shall be requested to: a) Conduct the assigned role to the best of his/her ability; b) Read and understand: i. The entire text of HKSQC 1 and the related standards (such as HKSA 220) ii. The job description iii. The Firm s objectives and plans relating to quality improvement; c) Address identified issues on a timely basis and document their resolution; d) Review (at least annually) and update (where necessary) the Firm s policies and procedures in relation to their assigned area of responsibility.

6 Policies shall be sufficient to ensure ongoing compliance with each relevant requirement of HKSQC 1; e) Document/report on any instances of noncompliance with the Firm s policies; and, f) Ensure that the practice aids in use (such as checklists, software programs, forms, work programs and template letters) are up-to-date. 4 The firm environment (Partner/senior staff rotation) HKSQC CODE The following new policy and procedure is added: LONG-TIME ASSOCIATION WITH A CLIENT Where I have worked on an engagement for a prolonged period of time (such as seven years or more), familiarity threat and self-interest threat can occur. For audits of non- Public interest entities, an engagement quality control review shall be performed whenever the following circumstances exist: a) Significant third-party reliance will be placed on the engagement report, such as entities with a large number (greater than 25) of passive shareholders; b) A close personal or business relationship exists; or c) A recurring self-interest or intimidation threat arises such as from: i.

7 Annual billings, plus other related activities, for all services exceeding 10% of the Firm s annual billing volume ii. An unresolved threat or potentially significant legal/disciplinary actions. For audits of Public interest entities or where I conclude that such threats exist, I shall mitigate the threats by appointing an external person to perform an engagement quality control review or end the partner association of the client. 3 5 Engagement risk (Documentation) HKSA More detailed policies and procedures on 'Engagement Planning'. Extract of 2013 edition is as follows: ENGAGEMENT PLANNING At the beginning of each assurance engagement, the following activities shall take place: a) Confirm compliance with the client acceptance/continuance procedures outlined in this manual and that (as a result) the engagement may proceed; b) Obtain a signed engagement letter that outlines the terms of the engagement; c) Identify and document factors significant to the nature and timing of work to be performed; and d) For audit engagements: Document the overall audit strategy and audit plan, including the nature and extent of planned risk assessment procedures and further audit procedures.

8 6 Engagement risk (Documentation) HKSQC HKSA More detailed policies and procedures on 'Release of Engagement Reports'. Extract of 2013 edition is as follows: RELEASE OF ENGAGEMENT REPORTS On or before the date of an engagement report, I shall, through a review of my documentation, be satisfied that: a) For audit engagements, sufficient appropriate audit evidence has been obtained to support the conclusions reached and for the auditor s report to be issued; b) For review engagements, sufficient procedures have been performed to assess whether the information being reported on is plausible within the framework of appropriate criteria and for the review engagement report to be issued.

9 And c) For other assurance engagements, sufficient evidence has been obtained to support the conclusions reached and the wording of the report to be issued. Where an engagement report is to be signed and issued (in hard copy or electronic format), I shall not release, file or otherwise distribute it until: a) Sufficient appropriate evidence has been obtained which includes: i. Approval of the subject matter ( , financial statements) by those with the recognized authority ii. Resolution of all significant issues; and b) Approval to release the report has been obtained (in writing) from the engagement quality control reviewer (where applicable). 7 Engagement risk (Continual improvement) HKSQC - More detailed policies and procedures on 'Annual Self-assessment of Compliance with Quality Control'.

10 Extract of 2013 edition is as follows: ANNUAL SELF-ASSESSMENT ON COMPLIANCE WITH QUALITY CONTROL On or before [August 31] each year, I shall prepare a quality control monitoring report on my practice that shall include: a) Summary of monitoring activities undertaken during the year, including any completed file inspections (cyclical inspections) and inspections by third parties such as the Hong Kong practice inspector or other regulators; b) Changes made (if any) to the policies and procedures contained in 4 this manual or the Firm s information systems required to address: i. New developments in professional standards and regulatory and legal requirements ii. Changes in the nature of the Firm such as increased engagement risk iii.