ISQM (UK) 1 risk assessment template for a small firm: a worked quality-risk register
By Alon Zieve FCA · Last reviewed
Every UK audit firm, sole practitioners included, must run a risk assessment process under ISQM (UK) 1: establish the quality objectives, identify and assess the quality risks that threaten them, and design responses based on the reasons for each assessment. The standard sets the objectives and some of the responses. It does not give you the risks: those are the firm's own. This guide sets out an ISQM (UK) 1 risk assessment template worked for an illustrative firm with one responsible individual (RI), the responses the UK edition adds, and what the FRC said in May 2026 that it now looks for.
What does the ISQM (UK) 1 risk assessment require?
Five paragraphs carry the requirement. Paragraph 23 requires a risk assessment process that establishes quality objectives, identifies and assesses quality risks, and designs and implements responses. Paragraph 24 requires the objectives the standard specifies, which paragraphs 28 to 33 set out component by component, plus any the firm needs. Paragraph 25 requires the firm to understand the "conditions, events, circumstances, actions or inactions" that may adversely affect those objectives, listing factors about the firm and about its engagements, and to take into account how, and how far, each may do so. Paragraph 26 requires responses "based on, and responsive to, the reasons for the assessments given to the quality risks", including the responses in paragraph 34. Paragraph 27 requires policies to pick up information showing that objectives, risks or responses need to change.
A quality risk is defined in paragraph 16(r) as "a risk that has a reasonable possibility of: (i) Occurring; and (ii) Individually, or in combination with other risks, adversely affecting the achievement of one or more quality objectives." Not every risk meets that test, and A46 leaves the call to professional judgement.
The ISQM 1 quality objectives come from the standard; the ISQM 1 quality risks do not, so no bought-in list can settle them. The process is iterative (A40). In a less complex firm, A39 says, the person with operational responsibility may do the assessment, and the result "may be documented in a single document"; in the UK, paragraph 21-1 requires ultimate and operational responsibility to sit with someone eligible for appointment as a statutory auditor. The guide to UK auditing standards lists the related standards.
What goes in an ISQM 1 risk assessment template?
Each column in the register exists because a paragraph of the standard, or the FRC's 2026 paper, asks for what it records:
| Column | What it records | Where it comes from |
|---|---|---|
| Ref and component | Which component the risk sits in: one of the six that carry quality objectives (paragraph 6 lists eight; the risk assessment process and the monitoring and remediation process are the other two) | Paragraphs 6, 28 to 33 |
| Quality objective | The objective threatened, by paragraph | Paragraph 24 |
| Condition or event | The fact about the firm or its work that gives rise to the risk, and which paragraph 25(a) factor it is | Paragraph 25(a) |
| Quality risk | What could happen, worded as a risk | Paragraph 16(r) |
| Assessment and reason | High, Medium or Low, with one line on occurrence and effect | Paragraph 25(b), A48, A49, A205 |
| Basis | Gross: before the responses | FRC, May 2026 |
| Responses | The firm's own, and the specified ones flagged with their paragraph | Paragraphs 26, 34, 34-1 |
| Owner; monitored by | Who runs the response, and which monitoring tests it | Paragraphs 20, 37(a) |
| Last changed, note and last reviewed | When the row last changed and why, and, separately, when it was last reviewed (in the download; summarised in the change log below) | Paragraph 27 |
The reason column matters most: paragraph 26 builds the responses on it, A205 says the firm "may document the reasons for the assessment given to the quality risks", and paragraph 37(a) uses the same reasons to plan monitoring.
Word each risk as something that could happen, not as the failure it would cause. In ICAEW's 2021 webinar on quality risks: "'not doing X' is NOT a risk that threatens the achievement of X, it's the consequence of the risk crystallising".
Two small additions follow the FRC's May 2026 paper: a one-line threshold for "reasonable possibility", because the FRC lists the lack of one as a pitfall, and a short log of matters considered and not taken as quality risks, which it lists as good practice.
Assessing quality risks without a heat map
A rating scale is optional. A48 lists what the degree of a risk depends on: how the condition would affect the objective, how often it is expected to occur, how long it would take to have an effect and whether the firm could respond in that time, and how long the effect would last. It then says "the assessment of quality risks need not comprise formal ratings or scores, although firms are not precluded from using them". A49 adds that the responses are based on "the considered occurrence and effect".
Most firms do score. The FRC's May 2026 paper, Risk assessment processes ISQM (UK) 1, found ratings based on impact and likelihood, "usually on a scale of 1-3/5", and risks "usually rated on a gross basis, prior to identification of the mitigating responses". It also said that "for smaller firms, a less formal approach may be more appropriate". Its pitfalls, and what the worked register does about each, are in the table at the end of this guide.
So the worked register uses three levels, a one-line reason and a gross basis. The reason does what a score cannot: P1's cites the files where the gap was found, and R1's explains why a risk unlikely in any one year is still High.
A worked register for a one-RI firm
The register below is a worked ISQM 1 example, completed for Practice A, a firm invented for this guide: the same illustrative sole practice whose ISQM 1 annual evaluation is worked in its own guide. Practice A is a sole practitioner with one audit senior and 12 audits a year, and an evaluation date of 31 March 2026; this guide adds that audit earns a minority of its fees and that it prepares the accounts and tax computations for most audit clients. It is not ICAEW's template or any provider's. Every row starts from a fact about Practice A, so copied as it stands it would be the untailored register the FRC criticises.
It holds 15 quality risks (4 High, 9 Medium, 2 Low), as last reviewed on 30 September 2026. Its threshold for a "reasonable possibility" reads: more than remote within two years, whether on one audit or across the firm. S marks a response specified by paragraph 34 or 34-1. The same rows, with dates and change notes, open in Excel: Download the example register (CSV).
Governance and leadership
| Ref | Objective (para) | Condition (25(a) factor) | Quality risk | Assessment (gross) and reason | Responses (S = specified, para) | Owner; monitored by |
|---|---|---|---|---|---|---|
| G1 | 28(b), 28(c): leadership is accountable for quality and shows it | One person holds every leadership role and is engagement partner on all 12 audits (25(a)(i)c, leadership) | The sole practitioner's own calls on quality, such as cutting a budget or settling a contentious judgement, go unquestioned because no one in the firm has the standing to question them | High. Touches every audit; nothing inside the firm would detect it, and the effect lasts until someone from outside looks | External reviewer's yearly inspection and whole-firm review; a named external contact for consultation on contentious matters; engagement quality review where the firm judges a file needs one. S: 34(f)(iii) | Sole practitioner; monitored by external reviewer (whole-firm review) |
| G2 | 28(a)(iv), 28(e): quality in financial priorities; resources planned | Audit earns a minority of the practice's fees, beside accounts and tax work (25(a)(i)b, business model) | In a busy year, time and money for audit (training, software, the external reviewer) are cut because audit earns a small share of the fees | Medium. Likely in some years; the effect builds slowly and shows in monitoring before it reaches a report | Audit budget for training, software and external review set and recorded before each year starts; the senior's appraisal and pay take no account of non-audit work sold to audit clients. S: 34-1(i)(ii), 34-1(k) | Sole practitioner; monitored by annual evaluation; external reviewer (whole-firm review) |
G1 is the risk a sole practice's structure creates, so every response to it sits outside the firm.
Relevant ethical requirements
| Ref | Objective (para) | Condition (25(a) factor) | Quality risk | Assessment (gross) and reason | Responses (S = specified, para) | Owner; monitored by |
|---|---|---|---|---|---|---|
| E1 | 29(a): ethical requirements, including independence, understood and fulfilled | Several owner-managed clients audited for many years by the same engagement partner (25(a)(ii)b, types of entities) | A familiarity threat from a long relationship with an owner-manager is not recognised, so no safeguard is applied | Medium. Possible on a few files; the effect is gradual and shows only on the files the reviewer inspects | Tenure list reviewed at each continuance; threats assessed and recorded before continuing; annual independence confirmations from the sole practitioner and the senior. S: 34(a)(i), 34(b), 34-1(b)(ii), 34-1(c)(i), 34-1(c)(ii) | Sole practitioner; monitored by external reviewer (file inspection) |
| E2 | 29(a): ethical requirements, including independence, understood and fulfilled | The practice prepares the accounts and tax computations for most audit clients (25(a)(ii)a, types of engagement) | Accounts and tax work for an audit client give rise to self-review or management threats that are not assessed and safeguarded before the work starts | High. Arises on most audits every year, and an unsafeguarded threat goes to the objectivity of the opinion itself | Non-audit services assessed against the FRC Ethical Standard at acceptance and continuance; safeguards recorded on the audit file; breaches log. S: 34(a)(i), 34(a)(ii), 34-1(b)(ii), 34-1(c)(i), 34-1(c)(ii) | Sole practitioner; monitored by external reviewer (file inspection and whole-firm review) |
Acceptance and continuance
| Ref | Objective (para) | Condition (25(a) factor) | Quality risk | Assessment (gross) and reason | Responses (S = specified, para) | Owner; monitored by |
|---|---|---|---|---|---|---|
| A1 | 30(a)(ii): the firm can perform the engagement | Occasional approaches from entities of a kind the firm has not audited, such as a group or a charity (25(a)(ii)b, types of entities) | The firm accepts an audit it lacks the competence, time or resources to perform, because the gap is not identified at acceptance | Medium. Approaches are occasional, but an accepted gap affects the whole engagement and is hard to close once fieldwork starts | Acceptance checklist asks whether the entity is of a new kind; if so, consultation or an engagement quality review is planned before accepting, or the audit is declined; a gap found after acceptance is dealt with under the policy for information found after acceptance. S: 34-1(c)(iii), 34(d)(i), 34(f)(iii) | Sole practitioner; monitored by external reviewer (whole-firm review of acceptance decisions) |
| A2 | 30(b): financial priorities do not drive acceptance or continuance | Long-standing clients resist fee increases (25(a)(i)b, business model) | An audit is continued at a fee that cannot pay for the procedures it needs, and the work is cut to fit the fee | Medium. Likely at some continuances; the effect falls on the file, where the reviewer can see it | Time budget compared with the fee at each continuance, with a recorded decision where they do not match. S: 34-1(c)(iii) | Sole practitioner; monitored by external reviewer (file inspection) |
Engagement performance
| Ref | Objective (para) | Condition (25(a) factor) | Quality risk | Assessment (gross) and reason | Responses (S = specified, para) | Owner; monitored by |
|---|---|---|---|---|---|---|
| P1 | 31(c): professional judgement and scepticism | Owner-managed clients whose directors prepare their own going concern forecasts (25(a)(ii)b, types of entities) | The audit team records management's forecast but not its own challenge of the key assumptions, in going concern and other judgement areas | High. Found on two of six files read for the 31 March 2026 evaluation; it sits in judgement areas where an inappropriate report is possible | Work programme step requiring the challenge to be recorded; review checklist item on it; going concern work updated for ISA (UK) 570 (Revised March 2026) before it applies. S: 34-1(f)(ii) | Sole practitioner; senior; monitored by external reviewer (file inspection, extended going concern check) |
| P2 | 31(b): direction, supervision and review | The sole practitioner does much of the work on the smaller audits personally (25(a)(i)a, complexity) | Work the sole practitioner does personally is reviewed by no one before the report is signed, so an error in it goes undetected | Medium. Arises on every small file, but those files carry the fewest judgements; an error would surface only after signing, in inspection | Pre-issuance review by the external reviewer of one audit a year, chosen on risk; engagement quality review where a file's risks call for one. S: 34(f)(iii), 34-1(f)(ii) | Sole practitioner; monitored by external reviewer (file inspection) |
| P3 | 31(a): engagement teams fulfil their responsibilities, here documenting discussions of significant matters (ISA (UK) 230 para 10) | Much of the evidence comes in conversation with owner-managers (25(a)(ii)b, types of entities) | Explanations and judgements reached in discussion with the client never reach the file, so the file does not show the work that was done | Medium. Likely on most files, and hard to put right once the file is assembled | File completion checklist; the senior writes up client discussions the same day; the sole practitioner's review checks that each key explanation is on the file. S: 34-1(f)(ii) | Senior; sole practitioner; monitored by external reviewer (file inspection) |
P1 is the row the annual evaluation guide traces, from the external reviewer's finding to the November 2025 fix. P1 and P3 are both about what reaches the file.
If documentation is where your audit hours go, partner with Innate: the platform takes the hours out of the legwork on the workpapers, and your firm remains the auditor and signs.
Resources
| Ref | Objective (para) | Condition (25(a) factor) | Quality risk | Assessment (gross) and reason | Responses (S = specified, para) | Owner; monitored by |
|---|---|---|---|---|---|---|
| R1 | 32(a), 32(d): competent personnel; an engagement partner on each audit | One responsible individual, and no one else in the firm can sign (25(a)(i)a, complexity) | The death, incapacity or long absence of the sole practitioner leaves audits that no one in the firm can complete or sign | High. Unlikely in any one year but more than remote over two, and it would affect every audit at once, with little time to respond | Formal alternate arrangement for incapacity or death, confirmed to the Registration Committee (Audit Regulation 2.02A); audit timetable with slack before filing deadlines. S: 34-1(f)(iii), 34-1(j) | Sole practitioner; monitored by sole practitioner (yearly check the arrangement is current); external reviewer (whole-firm review) |
| R2 | 32(a)(i), 32(g): competence; methodology consistent with standards | ISA (UK) 240 (Revised March 2026) and ISA (UK) 570 (Revised March 2026) apply to periods beginning on or after 15 December 2026 (25(a)(i)e, professional standards) | The sole practitioner or the senior applies superseded procedures to audits of periods the revised standards cover | Medium. The first affected periods begin on or after 15 December 2026, which leaves time to train and update; the effect would reach every affected file | Training plan for both revisions; audit programme updated before the first affected planning; first affected file checked against the new requirements. S: 34-1(i)(i) | Sole practitioner; monitored by external reviewer (file inspection, first affected year) |
| R3 | 32(f), 32(h): appropriate technological resources, including from service providers | New commercial audit software, with AI features, brought in during the year (25(a)(i)d, resources and service providers) | An IT application or AI tool is used on audits before the firm has determined that it is appropriate for use | Medium. Happened once (software used for two months before its assessment); nothing wrong was found, but the effect would reach every file that used the tool | Written assessment before first use, and no tool on an audit until approved; client data kept within the approved tools' confidentiality terms. S: 34-1(m) | Sole practitioner; monitored by annual evaluation; external reviewer (whole-firm review) |
| R4 | 32(c), 32(h): individuals from service providers are appropriate | Monitoring and the sole practitioner's appraisal depend on one external reviewer (25(a)(i)d, resources and service providers) | The external reviewer is unavailable, or no longer competent or objective for the firm's audits, when monitoring falls due | Low. The reviewer is booked a year ahead under a written engagement; a slip would show in time to find another | Written engagement with the reviewer; competence and objectivity assessed on appointment and each year; a second reviewer identified | Sole practitioner; monitored by sole practitioner (annual evaluation) |
R1's first response is also a regulatory requirement: Audit Regulation 2.02A requires a sole practitioner to put "formal arrangements with an alternate" in place, to take effect on their incapacity or death, and confirm them to the Registration Committee. Its guidance says an alternate's RI status in their own firm does not let them act as RI for the sole practice, and that the alternate is not expected to carry on the business but could effect an orderly transition of clients to a new auditor; hence the timetable as a second response.
R3 is the row added at the 2026 evaluation: A47 warns that a resource brought in as a response "may give rise to" further quality risks. What to record about an AI tool is covered in the guide to the FRC AI audit guidance.
Information and communication
| Ref | Objective (para) | Condition (25(a) factor) | Quality risk | Assessment (gross) and reason | Responses (S = specified, para) | Owner; monitored by |
|---|---|---|---|---|---|---|
| I1 | 33(c)(i): information reaches personnel in time | Updates on standards and methodology reach only the sole practitioner's inbox (25(a)(i)b, business processes) | A change to the methodology, a standard or a firm policy reaches the sole practitioner but not the senior before the senior works on an affected audit | Medium. Likely while updates are frequent; the effect lasts until a review or an inspection catches it | Standing item at each audit's planning meeting on changes since the last audit; an updates log the senior signs | Sole practitioner; monitored by sole practitioner (planning review); external reviewer (file inspection) |
| I2 | 33(a): the information system captures relevant information | Complaints and incidents arrive informally, by phone or email (25(a)(i)b, business processes) | A complaint, or an incident with serious consequences for the integrity of the audit work, is handled informally and never reaches the risk assessment | Low. None in the year and the client base is small, so one would be noticed; but an unrecorded one would be lost to the register | Complaints and incidents log; each entry considered at the next review of the register. S: 34(c), 34-1(b)(i) | Sole practitioner; monitored by external reviewer (whole-firm review) |
Matters considered and not taken
| Considered | Where it comes from | Why it is not a quality risk for Practice A |
|---|---|---|
| Group audits | 34-1(g), 34-1(h); 25(a)(ii)a | No group audits in the portfolio. Revisit at once if row A1 leads to accepting one. |
| Listed and public interest entities | 34(e)(i), 34(f)(i), 34(f)(iv), 34-1(d) | None audited, and none sought. |
| Network requirements and services | 25(a)(i)f | Not a member of a network. |
| Personnel working from another country | FRC, May 2026 (sources of risk) | No staff or contractors work from outside the UK. |
| Merger or acquisition of another practice | A46 example; 25(a)(i)a | None planned. A merger would be a change to assess under paragraph 27. |
Which responses does ISQM (UK) 1 specify in the UK?
Paragraph 34 lists responses every firm must include, lettered (a) to (f), and the UK edition adds paragraph 34-1, lettered (a) to (m), much of it written for audits. An ICAEW summary of Jeremy Williams FCA's Practice Live 2022 talk, in its members' resources, warns that the IAASB's implementation guides "do not contain all of the specified responses required in the UK", so a template built on the international text will miss them. Paragraph 34-2 asks the firm to take into account "the scale and complexity of the firm's activities" when it applies 34-1, and to be able to demonstrate to the competent authority that its policies are appropriate for that scale. Here is where each sits in Practice A's register:
| Specified response (our summary) | ISQM (UK) 1 | Practice A's rows |
|---|---|---|
| Policies for threats to the ethical requirements, and for breaches | 34(a) | E1, E2 |
| Documented independence confirmation from personnel, at least annually | 34(b) | E1 |
| Receiving, investigating and resolving complaints and allegations | 34(c) | I2 |
| Information found after acceptance; acceptance required by law | 34(d) | A1 |
| Communicating with external parties about the system | 34(e) | Policy in the manual; (e)(i) does not apply (no listed clients) |
| Engagement quality reviews, including where the firm judges one an appropriate response | 34(f) | G1, A1, P2 |
| No owner intervenes in an engagement in a way that jeopardises independence and objectivity | 34-1(a) | Policy in the manual; no risk row while the sole practitioner is the only owner and engagement partner on every audit, checked each year |
| Recording serious incidents; managing threats under the FRC Ethical Standard | 34-1(b) | E1, E2, I2 |
| Before accepting or continuing an audit: independence, threats, competence and time, eligibility of the key audit partner | 34-1(c) | E1, E2, A1, A2 (for (iv), the key audit partner's eligibility, a policy in the manual and no risk row: the sole practitioner's eligibility is confirmed at each acceptance and continuance) |
| Further acceptance checks for public interest entities | 34-1(d) | Does not apply: no public interest entities (see risks not taken) |
| Access to information for a successor auditor | 34-1(e) | Policy in the manual; no risk row, which is checked each year |
| Internal quality control system; policies for carrying out, coaching, supervising and reviewing audits and organising the file; continuity of audit work | 34-1(f) | P1, P2, P3, R1 |
| Group audits: the competent authority's requests for component auditors' work | 34-1(g) | Does not apply: no group audits (see risks not taken) |
| Group audits: how that documentation is retained or reached | 34-1(h) | Does not apply: no group audits (see risks not taken) |
| Knowledge and experience of audit personnel; remuneration policies | 34-1(i) | G2, R2 |
| A key audit partner designated for each audit and actively involved | 34-1(j) | R1 |
| Sufficient resources and competent personnel for the key audit partner | 34-1(k) | G2 |
| Outsourcing important audit functions without impairing quality control or the competent authority's supervision | 34-1(l) | Policy in the manual; no risk row of its own. Practice A outsources no audit work: its external reviewer (monitoring, engagement quality reviews, the pre-issuance review) and its software are resources from service providers (16(v), A105), covered by rows R4 and R3 under 32(h). Checked each year |
| Confidentiality and professional secrecy | 34-1(m) | R3 |
The mapping runs both ways. A specified response must be in place even where no risk needs it, and A116 says the specified responses "alone are not sufficient". A response with no risk behind it, like 34-1(a), 34-1(e) and 34-1(l) here, is a prompt to ask whether a risk is missing. ICAEW's 2021 webinar called this "Many to Many – no orphans".
Is there an ISQM 1 manual template?
Not an official one. ISQM (UK) 1 sets what the firm's documentation must contain rather than its form: paragraph 58 requires the people assigned ultimate and operational responsibility, the quality objectives and quality risks, "a description of the responses and how the firm's responses address the quality risks", the monitoring and remediation record, and the basis for the annual conclusion. For audits, paragraph 58-1 adds UK records, among them written complaints, breaches other than minor ones, and the findings of the paragraph 56-1 evaluation. ICAEW's page on ISQM 1 design and implementation software options sets out several providers' own descriptions of their manuals, toolkits and software, and its 2022 article on scalability warned that "it won't be possible for these service providers to supply a ready-to-use set of objectives, risks and responses", because ISQM 1 requires them to be tailored to the firm. In the same article's words, "the risks are the 'horse' and the responses are the 'cart', not the other way round".
For a sole practice, the manual can be short. It holds:
- Roles. Who holds ultimate and operational responsibility, independence and monitoring (paragraphs 20, 21-1 and 58(a)); in Practice A, the sole practitioner for all four.
- The register. Objectives, risks, assessments and reasons, as above (58(b)).
- The responses. The policies and procedures the register points to, each described with the risks it addresses (58(c)).
- The monitoring plan. What the external reviewer inspects, and when.
- The evaluation record. The annual conclusion and its basis (58(e)).
The worked register is the second item for Practice A, and the file is free to adapt: Download the example register (CSV). ICAEW also published one practitioner's own list of quality risks for a small practice in December 2022. ACCA's March 2025 ISQM 1 self-diagnostic checklist is a useful completeness check against the standard, but it is a list of yes-or-no questions on the requirements, not a register of a firm's risks.
Keeping the register current
Paragraph 27 requires policies that pick up changes and lead, where needed, to new or modified objectives, risks or responses. A52 lets a less complex firm do this informally, when the person responsible meets the information "in the normal course of their activities". The FRC's 2026 paper expects a revisit "on an at least annual basis", with ad hoc triggers in between. For a small firm in 2026 and 2027, these are the triggers to watch:
- Revised standards. ISA 240 revised and ISA 570 revised apply to audits of periods beginning on or after 15 December 2026 (Practice A's row R2).
- New technology. The FRC names "adoption of new technologies (including generative AI)" as a trigger, and lists "assuming no changes to quality risks from increased or new uses of technology" as a pitfall (row R3).
- People and providers. A change in staffing, or of the external reviewer or other "key service providers" (rows R1, R4).
- The client base. A new kind of client, or a change in the work done for existing ones (rows A1, E2).
- Regulation. A new edition of the Audit Regulations; the current one took effect on 1 October 2026.
- Findings. Monitoring results, complaints and external inspections are information sources under A41, and A53 says remedial actions may add or change risks. A finding from a cold file review is one of them.
Practice A's change log for the past year reads:
- 2026-03-31, R3: Added at the annual evaluation (software used before it was assessed).
- 2026-05-31, P1: Going concern work updated for ISA (UK) 570 (Revised March 2026), with R2; responses first redesigned on 2025-11-30 after the external reviewer's going concern finding.
- 2026-05-31, R2: Added after the FRC published the revised standards on 30 April 2026.
- 2026-09-30, all 15 rows: reviewed by the sole practitioner; none changed.
The register is also something the annual evaluation tests. A deficiency includes a quality risk that "is not identified or properly assessed" (paragraph 16(a)(ii)), so an evaluation should ask whether the register kept up with the year's changes. How to run that evaluation is covered in the guide to the ISQM 1 annual evaluation.
What the FRC now looks for in a risk assessment
The FRC has said that its "supervisory activities will include inspecting firms' risk assessment processes and outputs, focusing on changes". Its May 2026 paper calls risk assessment an area of regulatory focus, with findings "across firms of varied sizes", and lists good practice and pitfalls. Most of the pitfalls have a small-firm answer in the worked register:
| FRC pitfall (May 2026) | What Practice A's register does |
|---|---|
| "Boilerplate risks that aren't relevant or tailored to the firm" | Every risk starts from a fact about Practice A in the condition column |
| "Excluding baseline risks where mitigations are in place" | Risks are assessed gross, so E2 and R1 stay in although responses exist |
| "Lack of clear threshold for reasonable possibility" | One line at the head of the register |
| "Unclear if risk assessment is on a net or gross basis" | A basis column: gross |
| "Lack of robust justification and evidence to support risk assessments" | A reason for every assessment |
| "Assessments of likelihood not considering the results of SoQM monitoring" | P1 and R3 cite the findings of the 31 March 2026 evaluation |
| "Failing to update the risk assessment even annually" | A dated review and a change log |
| Leadership's "boilerplate sign-off only" | The sole practitioner's review records what changed and why |
Among the governance processes the FRC describes for a less complex firm are "informal discussion of risks and changes to risks" and "periodic evidence of approval". In a sole practice the evidence is the dated review and the change log. ICAS's July 2026 summary of the paper put the message the same way: firms should be ready to show at a monitoring visit that their processes are proportionate, tailored and responsive to change.