Audit Firm Quality Management in Nepal — From Risks to Evidence

Engagement quality review, where required, needs an eligible reviewer, appropriate timing and documented completion. It is not a signature added after issuing the report. Consultation should record the question, advice, conclusion and implementation.

A small firm accepts a new regulated client requiring specialist valuation expertise. The quality assessment identifies a competence gap before acceptance, arranges an appropriately qualified resource, documents responsibilities and plans review. If the resource cannot be obtained, the firm must address whether it can accept or continue the engagement. A generic annual training attendance list does not resolve the specific gap.

Evaluate findings for significance and recurrence, identify root causes and implement proportionate responses. Track whether the correction works. A late file sign-off may reveal a scheduling or supervision weakness rather than only one missing signature. Preserve original findings and corrective evidence instead of rewriting the inspection record.

The responsible person should evaluate the system using the applicable standard and evidence, documenting deficiencies and remediation. Confirm the current ICAN/AuSB timetable and the firm’s engagement scope when performing that evaluation.

ICAN's published NSA 2024 table gives mandatory compliance from 1 Shrawan 2083 for NSQM 1, NSQM 2, NSA 220 (Revised), NSA 600 (Revised) and NSRS 4400 (Revised). As at 12 October 2026, a firm should assess the applicable engagement and reporting period against that timetable. An old quality-control manual labelled NSQC 1 is insufficient evidence that the new requirements have been implemented.

Quality management begins with the firm's circumstances. A sole practitioner serving a few private companies faces different resources and engagement risks from a firm auditing regulated groups, but both need a reasoned system appropriate to their work. A smaller firm can document a proportionate system; it should not treat size as an exemption from the applicable standard.

A firm identifies recurring problems with late client records, dependence on one specialist and insufficient time for senior review. Its responses might include acceptance criteria requiring reliable reporting capacity, earlier specialist involvement, a backup resource arrangement and protected review milestones. The response should show how it reduces the identified risk.

Responsibility must be explicit. Assign who approves acceptance, monitors independence, appoints reviewers, checks consultation outcomes and assesses completed engagements. Where an engagement quality review is required, confirm reviewer eligibility and timing under NSQM 2 and the engagement standard. A colleague's informal read-through is not automatically an engagement quality review.

For example, a review finds that related-party disclosures were omitted in several company audits. The firm investigates whether the cause was the client questionnaire, audit planning, staff understanding or review practice. It then revises the relevant response and examines later engagements to see whether the issue recurs.

Annual evaluation should draw on monitoring results, complaints, external inspection findings and changes in the practice. Keep the conclusion, evidence and unresolved deficiencies. The objective is a system that supports consistent engagement quality and addresses weaknesses before they become routine, not a large manual assembled once and left unchanged.