Engagement Acceptance and Audit Quality Management

Introduction and context

An audit begins before the first transaction is tested. The decision to accept or continue an engagement determines whether the auditor can obtain sufficient appropriate evidence, comply with ethical requirements, deploy competent resources, and issue a credible report. Poor acceptance decisions create risks that cannot be fully corrected by careful work later. For this reason, engagement acceptance and quality management are central parts of professional auditing rather than administrative preliminaries.

This chapter examines the preconditions for an audit, client acceptance and continuance, engagement letters, auditor responsibilities, professional scepticism and judgement, consultation, and firm-level quality management under the International Standard on Quality Management (ISQM) framework. The discussion is principally based on International Standards on Auditing (ISAs), the IESBA International Code of Ethics, ISQM 1, and ISQM 2. Local law and professional regulation may impose additional requirements.

Learning objectives

By the end of this chapter, a student should be able to:

1. Explain the preconditions for accepting an audit engagement.
2. Analyse client acceptance and continuance risks.
3. Describe the purpose and contents of an engagement letter.
4. Distinguish management’s responsibilities from the auditor’s responsibilities.
5. Explain how professional scepticism and professional judgement affect audit quality.
6. Explain the role of consultation and engagement quality reviews.
7. Describe the components of a firm’s system of quality management under ISQM 1.
8. Apply these principles to an engagement acceptance decision.

1. Audit quality and the engagement life cycle

Audit quality is not a single measurable characteristic. It is the likelihood that an audit is planned, performed, supervised, reviewed, and reported in accordance with professional standards and applicable law, and that the auditor’s report is appropriate in the circumstances. Quality includes both the quality of the audit process and the reliability of the resulting communication.

An engagement normally passes through the following connected stages:

The acceptance decision is a risk filter. It considers not only whether the client appears profitable, but whether the engagement is ethically permissible, technically feasible, adequately resourced, and capable of being performed to the required standard.

2. Preconditions for an audit

Before accepting an audit, the auditor must establish that the preconditions for an audit are present. These preconditions are essential because an audit cannot succeed if the underlying basis for the engagement is unacceptable.

2.1 An acceptable financial reporting framework

Management must use an acceptable financial reporting framework in preparing the financial statements. Examples include IFRS Accounting Standards, a national framework based on law, or another framework permitted by the engagement circumstances. The framework must be suitable for the intended users and appropriate to the nature of the entity.

The auditor should consider whether the framework provides reasonable criteria for measuring, presenting, and disclosing financial information. A framework designed solely for internal management use may not be suitable for general-purpose financial statements intended for external users.

2.2 Management’s acknowledgement of responsibility

Management must acknowledge responsibility for:

• preparing and fairly presenting the financial statements in accordance with the applicable framework;
• establishing internal control necessary to enable financial statements free from material misstatement, whether due to fraud or error; and
• providing the auditor with access to information, records, explanations, and relevant personnel.

These responsibilities cannot be transferred to the auditor. An auditor may assist management with technical matters in limited circumstances, but must not assume management responsibility or become part of the entity’s decision-making process.

2.3 Agreement that the audit will be performed under appropriate standards

The auditor and management should agree that the audit will be conducted in accordance with applicable ISAs or other relevant auditing standards. If management expects a limited review, compilation, or assurance engagement while the auditor believes a full audit is necessary, the parties must resolve the difference before acceptance.

2.4 No unacceptable scope limitation

The auditor must consider whether management or circumstances are likely to impose a limitation that would prevent the auditor from obtaining sufficient appropriate evidence. A restriction on access to records, inventory locations, confirmations, or key personnel may create a scope limitation. If the limitation is so significant that the auditor would likely disclaim an opinion, the engagement generally should not be accepted unless required by law.

3. Client acceptance and continuance

Acceptance concerns a new client or a new engagement for an existing client. Continuance concerns the decision to retain an existing client or engagement. Both decisions require documented evaluation, although continuance benefits from knowledge gained during prior audits.

3.1 Information considered

A firm commonly evaluates:

• the integrity of owners, directors, senior management, and those charged with governance;
• the entity’s business model, industry, regulatory environment, and financial condition;
• reasons for changing auditors and communication with the predecessor auditor;
• management’s attitude toward financial reporting, internal control, and audit adjustments;
• possible illegal acts, fraud, money laundering, sanctions, or regulatory breaches;
• independence and other ethical requirements;
• competence, time, specialists, technology, and other resources;
• fees, payment history, and commercial pressure;
• litigation, reputational exposure, and conflicts of interest; and
• whether the firm can comply with legal and professional requirements.

No single factor automatically determines acceptance in every case. However, evidence of dishonesty by senior management, serious unresolved independence threats, or an impossible scope restriction should normally lead to rejection or withdrawal.

3.2 Integrity of management

Management integrity is particularly important because auditors obtain much evidence from information prepared or controlled by management. Warning signs include:

• reluctance to provide records or explanations;
• aggressive or implausible accounting positions;
• repeated pressure to reduce audit procedures or delay adjustments;
• a history of regulatory violations or misleading disclosures;
• unusually high management turnover in finance;
• unexplained related-party transactions; and
• attempts to influence the auditor’s opinion through fee negotiations.

A profitable client is not necessarily an acceptable client. The expected fee must never override concerns about integrity, independence, or auditability.

3.3 Communication with the predecessor auditor

When a new auditor is being considered, professional communication with the predecessor auditor, subject to client permission and applicable law, can identify disagreements about accounting principles, audit scope, unpaid fees, management integrity, or access to information. The proposed auditor should make reasonable efforts to obtain relevant information and should consider the consequences if the client refuses permission without a persuasive reason.

3.4 Independence and ethical threats

Independence comprises independence of mind and independence in appearance. The auditor must be able to form an objective conclusion and must avoid circumstances that would lead a reasonable and informed third party to conclude that objectivity has been compromised.

Common threats include self-interest, self-review, advocacy, familiarity, and intimidation. Safeguards may include removing an individual from the engagement, using an independent reviewer, restricting non-audit services, rotating personnel, or declining the engagement. Safeguards are not a substitute for withdrawal where the threat cannot be reduced to an acceptable level.

3.5 Competence and resources

Acceptance should occur only when the firm can assign personnel with suitable technical knowledge, industry experience, time, and professional judgement. Some engagements require specialists in taxation, valuation, actuarial matters, information technology, financial instruments, or sustainability reporting. The firm must also consider whether it can supervise remote teams, use audit software reliably, and complete the work by the reporting deadline.

4. The engagement letter

An engagement letter is a written agreement that records the terms of the audit. It reduces misunderstanding and establishes a common basis for planning and performance. The letter should be issued before the audit begins, normally after the acceptance decision and before significant work is performed.

Important contents generally include:

• the objective and scope of the audit;
• management’s responsibility for the financial statements;
• management’s responsibility for internal control;
• management’s responsibility to provide access to information and personnel;
• the auditor’s responsibility to conduct the audit in accordance with applicable standards;
• the expected form and content of the auditor’s report;
• inherent limitations of an audit, including the possibility that material misstatements may remain undetected;
• arrangements for communication with those charged with governance;
• identification of the applicable financial reporting framework;
• use of component auditors, experts, or internal auditors where relevant;
• billing arrangements and other administrative matters; and
• arrangements for electronic access, confidentiality, and data security where relevant.

The engagement letter does not eliminate the auditor’s professional responsibilities. Nor does it convert the audit into a guarantee that the financial statements contain no fraud or error. An audit provides reasonable assurance, not absolute assurance.

If circumstances change materially—for example, a change from owner-managed reporting to statutory reporting, a major acquisition, or a change in reporting framework—the auditor should consider whether the terms require revision and renewed agreement.

5. Auditor responsibilities, scepticism, and judgement

5.1 Reasonable assurance

Reasonable assurance is a high, but not absolute, level of assurance. Absolute assurance is generally unattainable because audits involve sampling, judgement, the limitations of internal control, persuasive rather than conclusive evidence, and the possibility of collusion or management override.

The auditor’s objective is to reduce audit risk to an acceptably low level. Audit risk is commonly described conceptually as the risk that the auditor expresses an inappropriate opinion when the financial statements are materially misstated. A traditional model expresses this as:

where AR is audit risk, IR is inherent risk, CR is control risk, and DR is detection risk. The model is a planning framework, not a precise numerical calculator. The components are not normally measured objectively as percentages, and the relationship should not be used to justify inadequate evidence. When assessed risks of material misstatement increase, the auditor generally responds by reducing acceptable detection risk through more persuasive, extensive, or better-timed procedures.

5.2 Professional scepticism

Professional scepticism is an attitude that includes a questioning mind, alertness to conditions indicating possible misstatement due to fraud or error, and a critical assessment of audit evidence. It does not mean assuming that management is dishonest. It means avoiding both unjustified trust and unjustified suspicion.

Scepticism is especially important when:

• evidence is internally inconsistent;
• estimates depend on optimistic assumptions;
• transactions are unusual or complex;
• evidence is obtained from a source with a conflict of interest;
• management has incentives to meet earnings targets; or
• subsequent events contradict earlier representations.

A written management representation is generally weaker evidence than independent external evidence. Scepticism requires the auditor to consider whether additional procedures are necessary rather than accepting a convenient explanation without corroboration.

5.3 Professional judgement

Professional judgement is the application of relevant training, knowledge, and experience within the context of auditing, accounting, and ethical standards to make informed decisions. It affects materiality, risk assessment, sampling, evidence evaluation, accounting estimates, going concern, and reporting.

Judgement can be distorted by confirmation bias, anchoring, overconfidence, availability bias, group pressure, and commercial incentives. Quality management can reduce these effects through consultation, supervision, challenge, documentation, and independent review.

Good documentation should enable an experienced auditor with no previous connection to the engagement to understand the procedures performed, evidence obtained, significant matters identified, and conclusions reached. Documentation is not a substitute for performing procedures, but undocumented work is difficult to defend or review.

6. Consultation and engagement quality review

Consultation involves discussion at the appropriate professional level with persons inside or outside the engagement team who possess relevant expertise. It is appropriate for difficult or contentious matters such as:

• complex revenue recognition;
• impairment and fair value estimates;
• going-concern uncertainty;
• legal or regulatory issues;
• independence questions;
• modified opinions; and
• disagreements within the engagement team.

The auditor should document the subject, scope, conclusions, and how those conclusions were implemented. Consultation must be genuine. It should not be used merely to obtain a superficial approval of a decision already made.

ISQM 2 addresses the engagement quality review. For engagements requiring such a review, an engagement quality reviewer performs an objective evaluation of significant judgements and conclusions before the report is dated. The reviewer must have appropriate competence, authority, time, and independence from the engagement team. The reviewer does not replace the engagement partner and must not assume responsibility for performing the audit.

7. Firm-level quality management under ISQM 1

ISQM 1 requires a firm to design, implement, and operate a system of quality management. The system is risk-based and proportionate to the nature and circumstances of the firm and its engagements. It is not simply a checklist or annual inspection exercise.

The principal components are:

7.1 The firm’s risk assessment process

The firm identifies quality risks, assesses their significance, and designs responses. A quality risk is a risk that one or more quality objectives will not be achieved. The process should be continuous and responsive to changes in clients, personnel, technology, regulation, and the firm’s operating model.

7.2 Governance and leadership

Leadership is responsible for creating a culture in which quality is paramount. Performance evaluation, promotion, remuneration, and resource allocation should not reward revenue generation at the expense of professional standards. Leaders should communicate that difficult issues must be escalated and that staff will not be penalised for raising concerns in good faith.

7.3 Relevant ethical requirements

The firm establishes policies and procedures for independence, conflicts, confidentiality, financial interests, gifts and hospitality, non-audit services, and other ethical matters. Acceptance systems should prevent work from beginning when independence has not been established.

7.4 Acceptance and continuance

The firm sets criteria for accepting and retaining clients and engagements. These criteria incorporate integrity, competence, resources, legal requirements, and the ability to perform quality work. Exceptions should be documented and approved at an appropriate level.

7.5 Engagement performance

The firm’s policies should support planning, supervision, review, consultation, professional scepticism, documentation, and resolution of differences of opinion. Automated audit tools may assist performance, but they do not eliminate the need to understand the entity, evaluate evidence, and exercise judgement.

7.6 Resources

Resources include people, technological tools, intellectual resources, and financial support. The firm should ensure that personnel have appropriate competence and that audit software, data extraction tools, templates, and technical guidance are current, secure, and fit for purpose.

7.7 Information and communication

Relevant information must reach those who need it. This includes technical updates, independence alerts, changes in law, inspection findings, consultation outcomes, and information about emerging risks such as cyber incidents or unreliable data.

7.8 Monitoring and remediation

The firm monitors whether its quality system is designed, implemented, and operating effectively. Monitoring may include inspections of completed engagements, thematic reviews, root-cause analysis, and review of complaints or regulatory findings. Remediation should address underlying causes rather than merely correcting an individual file.

8. Technology and artificial intelligence

Audit firms increasingly use data analytics, automated confirmations, electronic working papers, and artificial intelligence. These tools may improve efficiency and identify unusual patterns, but technology creates additional quality risks. The auditor should consider data completeness, data accuracy, model reliability, access controls, cybersecurity, confidentiality, bias, explainability, and whether the tool is suitable for the audit objective.

An AI-generated risk flag is not audit evidence by itself. The auditor remains responsible for understanding how a tool produced an output and for obtaining sufficient appropriate evidence. Confidential client information should not be entered into an external system unless authorised, secure, and consistent with professional and legal obligations.

9. Illustrative case: accepting Meridian Components Ltd

Background

This illustrative case concerns Meridian Components Ltd, a rapidly expanding manufacturer seeking a new auditor after its previous auditor resigned. Meridian offers an attractive fee and promises future consulting work. Its chief executive owns 65% of the company, and the finance director has recently departed.

Problem

During preliminary inquiries, Meridian refuses permission to contact the predecessor auditor, stating that the resignation resulted from “personality differences.” Management also insists that the auditor cannot attend the year-end inventory count because production must continue. The company uses complex long-term contracts and has breached a bank covenant, although management expects a waiver after year-end.

The proposed engagement partner identifies the following risks:

• possible management integrity concerns;
• inability to obtain evidence about opening balances and the predecessor’s reasons for resignation;
• an inventory observation limitation;
• significant revenue-recognition and going-concern risks;
• possible self-interest and familiarity threats from the promised consulting work; and
• pressure to accept the client because of the attractive fee.

Analysis

The firm should not treat the fee as compensation for accepting elevated risk. It should seek client permission to communicate with the predecessor auditor and obtain sufficient information about the resignation. It should evaluate alternative procedures for inventory only if those procedures could provide sufficient appropriate evidence. It should clarify the covenant status with the bank and assess management’s forecasts and disclosures.

The proposed consulting work must be considered under applicable ethical requirements. If it creates a prohibited self-review threat or cannot be reduced to an acceptable level, it must be declined. The firm should also determine whether it has personnel competent in contract accounting, valuation, and going-concern assessment.

Approach and outcome

Meridian eventually permits predecessor communication. The predecessor reports repeated disagreements over aggressive contract revenue and management’s refusal to record material adjustments. Meridian still refuses access to a major warehouse and will not permit alternative attendance procedures. The firm concludes that management integrity is unacceptable and that the likely scope limitation could prevent an appropriate opinion. It declines the engagement and documents the reasons.

Learning points

1. Acceptance is a professional risk decision, not a sales decision.
2. Client refusal to permit predecessor communication is significant information.
3. Scope limitations should be assessed before acceptance, not after fees are earned.
4. Management’s integrity affects the reliability of audit evidence.
5. Quality management protects the firm when commercial incentives create pressure.

10. Challenges, limitations, and best practices

Acceptance decisions are difficult because information is incomplete and incentives may conflict. A firm may face pressure to grow, retain staff, meet budgets, or enter a new industry. Smaller firms may have limited access to specialists, while larger firms may face complex global independence issues.

Best practices include:

• using a documented, risk-based acceptance and continuance form;
• obtaining independent information rather than relying only on management representations;
• requiring approval for high-risk or public-interest engagements;
• completing independence and conflict checks before work begins;
• setting clear escalation thresholds;
• agreeing engagement terms in writing;
• assigning suitably competent staff and specialists;
• encouraging consultation without stigma;
• documenting significant judgements and their rationale; and
• using monitoring results to improve policies, training, and leadership behaviour.

A firm should also distinguish a difficult engagement from an unacceptable engagement. Difficulty may be manageable with additional expertise, time, and review. An unacceptable engagement is one in which ethical, legal, integrity, or evidence constraints prevent the firm from performing quality work.

Chapter Summary

Engagement acceptance and continuance establish whether an audit can be performed ethically, competently, and in accordance with professional standards. The preconditions for an audit include an acceptable reporting framework, management’s acknowledgement of its responsibilities, agreement on the audit basis, and the absence of an unacceptable scope limitation.

Client integrity, independence, competence, resources, predecessor communication, legal exposure, and commercial pressure must be evaluated before acceptance and throughout continuance. The engagement letter clarifies responsibilities, scope, reporting, access to information, and inherent limitations. It does not convert an audit into a guarantee.

Professional scepticism requires a questioning mind and critical evaluation of evidence. Professional judgement is necessary but can be affected by bias and pressure; consultation, supervision, documentation, and independent review help control those risks. ISQM 1 requires a firm-wide, risk-based system covering governance, ethics, acceptance, engagement performance, resources, communication, monitoring, and remediation. ISQM 2 supports objective engagement quality reviews where required. Technology and AI can assist audit work, but responsibility for evidence and conclusions remains with the auditor.

Key Terms

Audit quality: The likelihood that an audit is performed properly and results in an appropriate report.

Acceptance: The decision to undertake a new audit engagement or client relationship.

Continuance: The decision to retain an existing client or engagement.

Preconditions for an audit: Conditions that must exist before an audit can appropriately be accepted.

Financial reporting framework: The criteria used to prepare and present financial statements.

Management responsibility: Responsibility for financial statements, internal control, and access to information.

Engagement letter: Written agreement setting out the terms of an audit.

Independence: Objectivity in fact and appearance.

Professional scepticism: A questioning mind and critical assessment of evidence.

Professional judgement: Informed application of relevant knowledge and experience.

Audit risk: Risk of an inappropriate audit opinion when financial statements are materially misstated.

Detection risk: Risk that audit procedures fail to detect a material misstatement.

Consultation: Discussion of difficult matters with appropriate technical or professional specialists.

Engagement quality review: Objective evaluation of significant judgements and conclusions before the report date.

ISQM 1: Standard requiring a firm-wide system of quality management.

ISQM 2: Standard addressing engagement quality reviews.

Quality risk: Risk that a quality objective will not be achieved.

Monitoring: Evaluation of whether the quality management system operates effectively.

Remediation: Action addressing identified deficiencies and their underlying causes.

Scope limitation: Restriction preventing the auditor from obtaining necessary evidence.

Review Questions

Short Answer Questions

1. What are the principal preconditions for accepting an audit?
2. Why is communication with a predecessor auditor important?
3. State three matters normally included in an engagement letter.
4. What is meant by professional scepticism?
5. Why does ISQM 1 require monitoring and remediation?

Long Answer Questions

1. Explain the factors a firm should consider when evaluating client integrity and continuance.
2. Discuss the distinction between management’s responsibilities and the auditor’s responsibilities.
3. Explain how professional judgement and professional scepticism interact during an audit.
4. Describe the principal components of a firm’s system of quality management under ISQM 1.
5. Evaluate the purposes and limitations of an engagement letter.

Analytical / Application Questions

1. A prospective client refuses access to inventory records but offers an unusually high fee. Analyse whether the engagement should be accepted and identify further information required.
2. An audit team accepts management’s optimistic impairment forecast because it is consistent with the prior year. Identify possible judgement biases and propose appropriate audit responses.
3. A firm’s inspection finds repeated inadequate consultation on complex estimates. Using the ISQM framework, recommend a remediation plan that addresses root causes rather than only individual files.

Multiple Choice Questions with Answers

Question 1

Which of the following is a precondition for an audit?

A. Management acknowledges responsibility for the financial statements and internal control

B. The auditor guarantees that no fraud exists

C. The client promises future consulting work

D. The auditor accepts management’s preferred accounting treatment

Correct Answer: A. Management acknowledges responsibility for the financial statements and internal control

Question 2

Which factor is most directly relevant to evaluating management integrity?

A. The colour of the company logo

B. Repeated refusal to record material audit adjustments

C. The age of the entity’s office building

D. The auditor’s preferred software

Correct Answer: B. Repeated refusal to record material audit adjustments

Question 3

What is the primary purpose of an engagement letter?

A. To guarantee an unmodified opinion

B. To replace audit documentation

C. To record the agreed scope, responsibilities, and terms of the audit

D. To transfer management responsibility to the auditor

Correct Answer: C. To record the agreed scope, responsibilities, and terms of the audit

Question 4

Professional scepticism requires the auditor to:

A. Assume all management is dishonest

B. Accept management representations without corroboration

C. Maintain a questioning mind and critically assess evidence

D. Refuse to use any evidence produced by management

Correct Answer: C. Maintain a questioning mind and critically assess evidence

Question 5

In the conceptual audit-risk model, if assessed risk of material misstatement increases, the auditor will generally seek to:

A. Increase acceptable detection risk

B. Reduce detection risk through stronger procedures

C. Eliminate all inherent risk

D. Issue the report without further work

Correct Answer: B. Reduce detection risk through stronger procedures

Question 6

Which standard addresses a firm-wide system of quality management?

A. ISQM 1

B. ISA 210 only

C. ISQM 2 only

D. IAS 2

Correct Answer: A. ISQM 1

Question 7

Which activity is most clearly an example of consultation?

A. Deleting contradictory evidence from the working papers

B. Discussing a complex fair-value issue with an appropriate specialist

C. Allowing the client to approve the audit opinion

D. Replacing all audit procedures with an AI output

Correct Answer: B. Discussing a complex fair-value issue with an appropriate specialist

Question 8

What is the role of an engagement quality reviewer?

A. To assume the engagement partner’s responsibility

B. To prepare the client’s financial statements

C. To objectively evaluate significant judgements and conclusions before the report date

D. To negotiate the audit fee

Correct Answer: C. To objectively evaluate significant judgements and conclusions before the report date

Question 9

Which response best addresses a scope limitation identified before acceptance?

A. Ignore it because the fee is attractive

B. Assess whether alternative procedures can provide sufficient appropriate evidence

C. Ask management to sign a guarantee

D. Automatically issue an unmodified opinion

Correct Answer: B. Assess whether alternative procedures can provide sufficient appropriate evidence

Question 10

Which statement about AI in auditing is correct?

A. An AI-generated risk flag is automatically sufficient audit evidence

B. Use of AI removes the auditor’s responsibility for conclusions

C. The auditor must consider data quality, reliability, security, and suitability of the tool

D. Confidential client information may always be uploaded to public AI tools

Correct Answer: C. The auditor must consider data quality, reliability, security, and suitability of the tool