Engagement Quality Review

What the EQR actually requires

The FRC's 2023 Audit Quality Inspection report found that engagement quality control review (EQCR) reviewers at several firms performed only a surface-level review of the audit file. They focused on documentation completeness rather than evaluating the substance of the engagement team's significant judgments. That finding is uncomfortably common, and it points to a broader problem: at too many firms, the EQR has become a tick box exercise rather than the genuine independent challenge ISQM 2 intended.

ISQM 2.18 requires the engagement quality reviewer to evaluate significant judgments the engagement team made and the conclusions it reached. The review covers the entire engagement, from acceptance through to the final report, but focuses on areas where judgment carries the most risk. The reviewer assesses whether the engagement team's conclusions on material accounting estimates, going concern, significant risk responses, and proposed report modifications are supportable given the evidence in the file.

The firm determines which engagements require an EQR through its ISQM 1 quality management system. Audits of financial statements (FS) of listed entities always require one (ISQM 2.5(a)). For other engagements, the firm sets criteria based on factors such as public interest and entity size, or specific regulatory requirements in the entity's jurisdiction. ISQM 2.19 requires the reviewer to evaluate the engagement team's basis for concluding on independence and significant risks identified during the engagement, as well as judgments made about materiality. The reviewer also assesses whether consultations on difficult or contentious matters were appropriate and whether the resulting conclusions were applied.

One hard constraint separates the EQR from every other quality check: the reviewer must complete it before the engagement team dates the report (ISQM 2.24). The firm cannot issue the audit opinion until the reviewer has notified the engagement partner (EP) that the EQR is complete and no unresolved matters remain. This sequencing requirement distinguishes the EQR from an internal post-issuance review or cold file inspection.

Worked example: Rossi Alimentari S.p.A.

Client: Italian food production company, FY2025, revenue €67M, IFRS reporter. A mid-tier Italian firm audits Rossi Alimentari. The firm's ISQM 1 policies require an EQR for all engagements with revenue above €50M and for entities operating in sectors with elevated fraud risk. Rossi qualifies on both grounds.

Step 1: appoint the engagement quality reviewer

The firm's quality management partner appoints Maria Conti, a senior partner with 18 years of audit experience in manufacturing and food production. She has had no involvement with the Rossi engagement in the current or prior two periods. The appointment occurs within two weeks of engagement acceptance to allow the reviewer to participate in discussions on the audit strategy.

Step 2: review the engagement strategy and significant planned judgments

Conti reviews the planned audit approach for two areas the engagement team flagged as significant risks: revenue cut-off on export shipments (Rossi ships to 14 EU markets with varying Incoterms) and the valuation of €4.2M in aged Parmigiano-Reggiano inventory requiring 24-month maturation. She discusses the planned substantive procedures for both areas with the EP and confirms the team's risk assessment is consistent with the identified fraud risk factors under ISA 240 .

Step 3: evaluate significant judgments made during execution

After fieldwork, Conti reviews the engagement team's conclusion on inventory valuation. Management valued the aged Parmigiano-Reggiano inventory at €4.2M using a net realisable value model that assumed a 6% price increase on matured wheels based on commodity price trends. The team accepted this assumption after comparing it to Consorzio published price indices showing a 5.8% trailing twelve-month increase. Conti also reviews the team's resolution of two unadjusted misstatements totalling €285,000 (individually and in aggregate below performance materiality (PM) of €390,000).

Step 4: assess the proposed audit report and complete the review

Conti reviews the draft unmodified opinion. She confirms that the team's going concern assessment is documented and that no matters requiring a key audit matter disclosure were overlooked. She also verifies that the summary of unadjusted misstatements was communicated to those charged with governance. She notifies the EP that the EQR is complete with no unresolved matters.

The EQR is complete and defensible because it covered each significant judgment (inventory valuation, revenue cut-off risk assessment, unadjusted misstatements, and the proposed opinion), was performed by a reviewer with relevant experience and no involvement in the engagement, and was finalised before the report date.

Why it matters in practice

The gap between what ISQM 2 requires and what actually happens on many engagements comes down to timing and depth. ISQM 2.18 requires evaluation of the judgments themselves, not just whether the file contains the expected working papers (WP). A reviewer who ticks through the file index without challenging the team's reasoning on key estimates is doing little more than ticking and bashing. At firms we have spoken to, this pattern is most common when the reviewer lacks sector-specific experience or was appointed too late to form an independent view.

Firms frequently appoint the EQR reviewer too late in the engagement cycle, leaving insufficient time for the reviewer to influence the audit approach on significant risks. ISQM 2.17 states that the appointment must be made at a time that allows the reviewer to fulfil the role effectively. An appointment in the final week of fieldwork converts the EQR into a rubber-stamp exercise, particularly when the report issuance deadline creates pressure to resolve disagreements quickly rather than thoroughly.

EQR vs. cold file review

The distinction matters because some firms conflate the two. A cold file review cannot substitute for an EQR. If the firm discovers during a post-issuance inspection that an EQR was required but not performed, ISQM 2.27 requires the firm to determine whether the engagement report needs to be recalled or reissued.

Related terms

Related reading

Jurisdiction notes

ISQM 2 (Quality Management for an Engagement Quality Review) applies globally. In the United Kingdom, ISQM (UK) 2 requires engagement quality reviews for audits of PIEs and other engagements where the firm determines a review is appropriate. The FRC expects the EQR reviewer to be sufficiently involved throughout the audit, not just at the reporting stage. In the Netherlands, the NBA requires engagement quality reviews under NV COS / ISQM 2 for statutory audits of PIE entities. The AFM has noted deficiencies where reviewers did not sufficiently challenge key audit judgements. In Australia, ASQM 2 mirrors the IAASB base standard. ASIC expects that the quality reviewer evaluates significant judgements including materiality and going concern.

In the United States, engagement quality review is governed by AU-C 220 for non-public entities and PCAOB AS 1220, Engagement Quality Review, for SEC registrant audits. AS 1220 requires an EQR and concurring approval of issuance for all audit engagements and interim reviews performed under PCAOB standards. The EQR reviewer must evaluate significant judgements, including the assessment of and response to significant risks and the engagement team's evaluation of the firm's independence. The reviewer must also consider whether appropriate consultations have taken place on difficult or contentious matters. AS 1220 also requires the reviewer to hold the report until the review is complete. No audit report may be issued without the reviewer's concurring approval. PCAOB inspection reports have cited deficiencies where the quality reviewer was not sufficiently involved in evaluating critical audit areas or where the review was performed after the report date.

Frequently asked questions