The ISQM (UK) 1 annual evaluation for small firms and sole practitioners, worked

Every UK audit firm, sole practitioners included, must carry out an ISQM (UK) 1 annual evaluation of its system of quality management. At least once a year, as of a chosen date, the individual with ultimate responsibility for the system concludes, in one of three set forms, whether it gives the firm reasonable assurance that its objectives are being achieved, and the firm documents the basis for that conclusion. This guide covers what the evaluation draws on, how to choose the conclusion, who reviews the reviewer in a one-RI firm, and a worked evaluation memo for an illustrative sole practice.

What does the ISQM (UK) 1 annual evaluation require?

The requirement is short. Paragraph 53 of ISQM (UK) 1 says the individual (or individuals) assigned ultimate responsibility and accountability for the system of quality management "shall evaluate, on behalf of the firm, the system of quality management", as of a point in time and at least annually. The first evaluation had to be performed within one year of 15 December 2022 (paragraph 13), so a firm that has audited throughout should by now have completed at least three. The current edition is the one updated in September 2025; the guide to UK auditing standards lists the others that bear on a firm's quality management.

Three details settle who does it. A sole practitioner is a firm: the definition in paragraph 16(i) starts with "a sole practitioner". In a firm that audits, the UK's paragraph 21-1 requires the ultimate and operational responsibility to be assigned to at least one individual eligible for appointment as a statutory auditor. And others may assist, but the individual with ultimate responsibility "remains responsible and accountable for the evaluation" (A187).

Based on the evaluation, that individual concludes, on behalf of the firm, one of the three conclusions in paragraph 54, quoted exactly:

(a) The system of quality management provides the firm with reasonable assurance that the objectives of the system of quality management are being achieved;

(b) Except for matters related to identified deficiencies that have a severe but not pervasive effect on the design, implementation and operation of the system of quality management, the system of quality management provides the firm with reasonable assurance that the objectives of the system of quality management are being achieved; or

(c) The system of quality management does not provide the firm with reasonable assurance that the objectives of the system of quality management are being achieved.

Four duties sit around the conclusion: action and communication after (b) or (c) (paragraph 55); periodic performance evaluations of the people with ultimate and operational responsibility, taking the evaluation into account (paragraph 56); documentation of "the basis for the conclusion" (paragraph 58(e)); and, a UK addition for audits, an annual evaluation of the internal quality control system in paragraph 34-1(f)(i), which covers at least the policies for carrying out audits, coaching, supervising and reviewing staff and organising the audit file, with its findings kept on record (paragraphs 56-1 and 58-1(d)(ii)). ICAEW's helpsheet covers the two evaluations together; the combined exercise is sometimes called the annual review. No independent assurance report on the system is required (A195).

When should a small firm do the evaluation?

At a point in time the firm chooses, at least once a year. The standard says the date "may coincide with the fiscal year end of the firm or the completion of an annual monitoring cycle" (A188), and paragraph 53 requires the evaluation as of a point in time and at least annually.

For a small practice the practical order is monitoring first, evaluation second. The ICAEW Audit Regulations' guidance to regulation 3.20 says that for the smallest firms with a limited number of audits, monitoring "may be focused on an annual audit compliance review process", so it makes sense to set the evaluation date after that review and any file inspections are finished. ICAEW's August 2024 quality assurance update described firms that planned their second evaluation to coincide with completing their annual return, and called that "a good practical approach". Its warning was on slippage: the important point was that the second evaluation was not delayed into the next calendar year.

What the evaluation draws on: monitoring and remediation

Monitoring and remediation is the process that produces the evidence the evaluation weighs; the evaluation is the conclusion drawn from it. Paragraphs 35 to 47 set the process out:

1. Monitoring activities are designed around the quality risks and responses, changes, earlier results, complaints, external inspections and information from service providers (paragraph 37).
2. Inspection of completed engagements is required, with "at least one completed engagement for each engagement partner on a cyclical basis determined by the firm" (paragraph 38(c)).
3. The people monitoring must be objective: engagement team members and the engagement quality reviewer may not inspect that engagement (paragraph 39(b)).
4. Findings are evaluated to decide whether deficiencies exist (paragraph 40), and each deficiency's severity and pervasiveness is assessed by investigating its root cause and its effect, individually and in aggregate (paragraph 41).
5. Remedial actions respond to the root cause, and the person responsible for monitoring and remediation checks they were implemented and work (paragraphs 42 to 44). Where an engagement had a required procedure omitted or the report may be inappropriate, the firm acts on that engagement too (paragraph 45).
6. Results are reported to the individual with ultimate responsibility and to engagement teams (paragraphs 46 and 47). In a less complex firm that individual "may be directly involved in the monitoring and remediation" and will already know what it found (A189).

The UK layer sits on top. Paragraph 35-1 requires firms that audit to monitor the adequacy and effectiveness of their systems and address deficiencies. Regulation 3.20 requires a registered auditor to monitor, at least once a year, how effectively it complies with the Audit Regulations. Its guidance splits monitoring into whole-firm procedures (governance and leadership, ethics, fit and proper status, competence, acceptance, professional indemnity insurance, eligibility) and the inspection of completed engagements, the cold file review. It then adds two rules beyond ISQM (UK) 1: each responsible individual's inspection cycle "must not exceed three years", and monitoring "must include at least one inspection of a completed engagement, each year". A firm should still monitor in a year when ICAEW has visited.

How the risk assessment feeds the evaluation

The evaluation tests the risk assessment as well as the responses. A deficiency includes a quality risk that "is not identified or properly assessed" (paragraph 16(a)(ii)), and paragraph 27 requires the firm to look for information showing that its quality objectives, risks or responses need to change. So the memo should say whether the risk register was updated for the year's changes, such as new staff, new software, a new kind of client or a revised standard. A worked quality-risk register for a small firm is a separate subject.

Resources from service providers

Paragraph 32(h) sets a quality objective the firm must establish: that human, technological or intellectual resources from service providers are appropriate for use in the firm's system and on its engagements. The examples in A105 include individuals engaged to perform the firm's monitoring and "a commercial IT application used to perform audit engagements", and the same paragraph says the firm "remains responsible for its system of quality management" whoever provides them. The evaluation therefore covers whether those resources were appropriate: in practice, whether each was assessed before use and still works as intended. Who stays responsible when a firm outsources audit work itself is covered in the guide to audit outsourcing. What to document about an AI tool, centrally and on the audit file, is covered in the guide to the FRC AI audit guidance. If your firm is assessing audit software as part of its quality management, partner with us: we bring clients and a platform designed to save your team hours, and you remain the auditor and sign.

Who monitors the monitor? The sole practitioner's problem

A sole practitioner can carry out the evaluation, but cannot perform the inspections ISQM (UK) 1 requires on their own files. In a sole practice one person holds every role: ultimate and operational responsibility for the system (paragraphs 20 and 21-1), audit compliance principal (regulation 3.21 says "a sole practitioner will be the audit compliance principal") and engagement partner on every audit. The rules answer the objectivity problem in four places:

• Inspections need someone else. Paragraph 39(b) bars engagement team members from inspecting their own engagements, and A155 adds that a self-review threat may arise where the inspector was on that audit "or an engagement for a subsequent financial period", and, for other monitoring, where the person helped design or operate the response monitored: in a sole practice, every response. A156 says a less complex firm without personnel with the competence, time or objectivity "may use network services or a service provider to perform the monitoring activities".
• The Audit Regulations' guidance. The regulation 3.20 guidance says a firm "that does not have a suitable internal reviewer meeting the criteria set out in ISQM1 should engage an external reviewer at least once every three years" ("should", where its inspection criteria say "must"). Only for inspections its one-a-year criterion adds beyond ISQM (UK) 1 may the firm relax independence from the engagement team, if it considers the person able to review "with a sufficiently independent and objective mindset"; the guidance does not say who that could be in a sole practice. Either way, "using an external reviewer does not reduce the firm's own responsibility". An external reviewer is a resource from a service provider (A105).
• The RI's own appraisal. Paragraph 56 applies to a sole practitioner too. A199 gives two options for a less complex firm: "engage a service provider to perform the evaluation", or let the results of the firm's monitoring "provide an indication of the performance of the individual".
• No exemption. A29 lists requirements that may not be relevant to a sole practitioner, such as assigning roles, direction, supervision and review, and differences of opinion. The evaluation is not among them.

The audit compliance principal "need not carry out the reviews personally", the regulations say, but should make sure they are carried out satisfactorily. One year then looks like this:

Choosing the conclusion: (a), (b) or (c)

The conclusion turns on three questions: is any deficiency severe, is it pervasive, and by the evaluation date has its effect been corrected and has remediation been shown to work? A190 lists those considerations. The FRC's September 2025 paper sets them out as a flowchart taken from the IAASB's first-time implementation guide:

Two points catch small firms out. First, (b) is about deficiencies that are severe but not pervasive. Some summaries describe it as deficiencies that are not severe; that is not the standard's wording, and deficiencies that are not severe do not stop conclusion (a). Second, pervasiveness is not a head count of audits. A192's indicators include a deficiency that "affects several components or aspects" of the system, one that is "fundamental" to it, and one that "affects a substantial portion of engagements that are of a certain type or nature". The FRC lists as a pitfall "assuming a deficiency is only pervasive if it affects all, or almost all, audits". In a one-office firm the indicators about business units and locations rarely apply, so the others do the work.

Nor is (b) or (c) a breach in itself. ICAEW said in August 2024 that firms should not view "B" or "C" conclusions "as failure or non-compliance with Audit Regulations in themselves", though a (c) "will of course be a concern for any firm"; what matters is understanding the root cause, remediating and monitoring again.

An annual evaluation template, worked for a one-RI firm

ICAEW's helpsheet says there is "no prescribed format" for the evaluation, and that "a standard 'checklist' approach is not suitable". What follows is one possible memo, completed for an illustrative firm invented for this guide, "Practice A", not a real practice and not ICAEW's template. Practice A is a sole practitioner with one audit senior and 12 audits a year, and an evaluation date of 31 March 2026.

Annual evaluation of the system of quality management, Practice A (illustrative)

1. Scope and date. The system of quality management as of 31 March 2026 (ISQM (UK) 1 paragraphs 53 to 54), and the annual evaluation of the internal quality control system (paragraph 56-1), covering the period since the last evaluation on 31 March 2025.
2. Who evaluated. The sole practitioner, as the individual with ultimate and operational responsibility and the audit compliance principal. The audit senior assembled the papers (A187). The conclusion is the sole practitioner's.
3. Information considered. The external reviewer's inspection of two completed audits and whole-firm compliance review (regulation 3.20), and extended going concern check on four more files; independence confirmations (paragraph 34(b)); CPD records; complaints (none); no ICAEW visit; last year's actions (closed); the risk register; the new audit software's assessment.
4. Findings.
   • F1: on one inspected file and one of the four extended files (two of six read), the work on the directors' going concern assessment recorded the forecast but not the audit team's challenge of its key assumptions.
   • F2: the audit senior's annual independence confirmation was signed after the firm's deadline.
   • F3: the new audit software was in use for two months before its assessment against paragraph 32(h) was written up.
5. Deficiencies, root cause, severity and pervasiveness. F2 is not a deficiency: the confirmation was obtained and disclosed no threat. F3 is a deficiency (paragraph 16(a)(ii): the risk of software used before assessment had not been identified), but not severe: one application, nothing wrong found on the files that used it. F1 is a deficiency in a response (paragraph 16(a)(iii)). Root cause: the work programme did not prompt the challenge, and review did not catch it. Severe: a judgement area, recurring across files. Not pervasive, on balance: confined to one aspect of engagement performance, not fundamental to the system, no similar gap in other areas; two of six files was weighed against A192's "substantial portion of engagements" indicator and judged short of it, a call another evaluator could make differently.
6. Remediation and its effect. Work programme and review checklist amended in November 2025. Under paragraph 45 the sole practitioner, with the reviewer, considered the two affected audits, including whether either report was inappropriate; neither was, and the reasons are recorded. Before the evaluation date the reviewer checked three audits completed after the change: no exceptions.
7. Conclusion. The severe deficiency was remediated and its effect corrected by the evaluation date, which A191 says may support (a), and the sole practitioner concludes (a): "The system of quality management provides the firm with reasonable assurance that the objectives of the system of quality management are being achieved." A191 covers severe and pervasive deficiencies too, so (a) does not turn on item 5's pervasiveness call. Without the follow-up check by 31 March 2026 there would have been no evidence the fix worked, and the conclusion would have been (b) on item 5's view of pervasiveness.
8. Risk assessment and responses. Quality risk added for new software being used before it is assessed; response: written assessment before first use. Going concern response redesigned (6).
9. Performance evaluation (paragraph 56). The sole practitioner's appraisal was carried out by the external reviewer under a separate engagement, taking this evaluation into account (A199).
10. Communication and sign-off. Monitoring results and actions communicated to the audit senior as they arose (paragraph 47); not a (b) or (c) conclusion, so paragraph 55 does not apply. Signed and dated by the sole practitioner. Paragraph 60 leaves the retention period to the firm (long enough to monitor the system, longer if law or regulation requires); Practice A uses six years, the floor paragraph 60-1 sets for audit documentation.

The memo is short because the firm is small. What makes it defensible is that each conclusion traces back to a finding, a reason and a date.

What happens if the conclusion is (b) or (c)?

The firm must take "prompt and appropriate action" and communicate (paragraph 55): to engagement teams and others in the system, as far as relevant to them, and to external parties under the firm's policy required by paragraph 34(e). A196 gives examples of the action: assigning more resources or developing guidance, confirming that reports issued "are appropriate in the circumstances" until the deficiencies are remediated, and obtaining legal advice. A198 lists when external communication may be appropriate, including when a report issued by the firm is found to be inappropriate and the client's management or those charged with governance need to know, and "when law or regulation requires the firm to communicate to an oversight authority or a regulatory body". On audits still to be reported in the affected area, one response a firm may choose is an engagement quality review under ISQM (UK) 2, which must be completed by the report date: paragraph 34(f)(iii) requires one where the firm determines it is an appropriate response to a quality risk.

What QAD and the FRC look for in the evaluation

ICAEW's Quality Assurance Department (QAD) set out its expectations in an August 2024 update: its reviewers "expect to see the conclusion documented, along with details of the results of the firm's monitoring that it has assessed to reach its conclusion". On most visits firms had done at least their first evaluation, but some had not, "and so have not complied with the Audit Regulations". Where a firm has not engaged with ISQM (UK) 1, including the annual evaluation, QAD said it will need evidence that this is resolved before closing the visit and is likely to select the firm for accelerated monitoring visits; if the firm still does not act, QAD will escalate to ICAEW's Audit Registration Committee and the FRC, which, ICAEW said, now requires notification of a firm's continuing failure to comply with the evaluation requirements. ICAEW also said compliance is "more than 'a cold file review' and 'ticking a checklist'", and that the judgements need to be documented.

The FRC's September 2025 paper expects smaller firms to need "fewer individuals and formal processes" and less formally structured leadership review. Several of its pitfalls are not about size: a narrow range of inputs, "assuming mitigating actions are effective without evidence", not considering whether recurrence increases severity or pervasiveness, and "failure to evidence the basis for leadership's conclusion".

The evaluation is one point in a continuous cycle, as ICAEW's helpsheet puts it. Next year's monitoring starts from this memo's action list and from checking that this year's fixes held.