Your Auditor Is Registered. But Is the Firm Meeting ISQM 1?

Inside ISQM 1 — the quality-management standard applicable to Nigerian audit firms since December 2022, and what Nigeria's regulatory framework actually requires

By Joe Adinma, FCA, FCTI — Managing Partner, Joe Adinma & Co. (Chartered Accountants) | Last updated: 27 September 2026

A Different Question

Our last article on this subject asked whether your auditor is even allowed to sign your accounts — whether the firm's FRC registration number is real, current, and properly affixed to the signing partner's signature. That question now has a clean, mechanical answer: check the National Register of Audit Firms.

This article asks a harder one. Registration answers an eligibility question. It does not answer an audit-quality question. It tells you nothing about whether the firm that produced a given audit actually has a functioning system for catching its own mistakes before they reach your financial statements.

That second question has its own standard — and, in Nigeria, its own regulation. Most business owners, and a fair number of practitioners, have never heard of either.

What ISQM 1 Actually Is

International Standard on Quality Management (ISQM) 1, Quality Management for Firms that Perform Audits or Reviews of Financial Statements, or Other Assurance or Related Services Engagements, replaced the old International Standard on Quality Control (ISQC 1) as the IAASB's global benchmark for how an accounting firm runs itself. For firms within its scope, ISQM 1 required compliant systems of quality management to be designed and implemented by 15 December 2022, with the first evaluation of that system due by 15 December 2023 and at least annually thereafter.

ISQC 1 was substantially more prescriptive and policy-driven — a fixed set of quality-control policies every firm maintained, largely regardless of whether they fit that firm's own circumstances. ISQM 1 changes the centre of gravity: instead of merely maintaining prescribed policies, each firm must identify the quality risks arising from its own circumstances and design responses to those specific risks, through what the IAASB describes as a “robust, proactive and scalable risk-based approach.”

In Nigeria, this is not merely an international standard firms happen to have adopted — it is embedded in Nigeria's domestic regulatory framework through Regulations 21–23 of the FRC's Audit Regulations 2020. Regulation 21 requires that quality assurance review of auditors be conducted “in line with International Standards on Quality Control/International Standards on Quality Management (ISQC1/ISQM), as may be revised from time to time.” Regulation 22 requires every auditor to run internal quality control mechanisms, to “carry out an annual evaluation of the internal quality control system,” to “keep records of findings of the evaluation and any proposed measure to modify” it, and to be able to “demonstrate to the Council that the policies and procedures designed to achieve such compliance are appropriate, given the scale and complexity of activities of the Auditor.” Regulation 23(1) is the direct domestic mandate: “Every Auditor and Audit firm shall implement a quality management system in compliance with ISQM as issued by IAASB and as may be revised from time to time” — a dynamic reference that automatically pulls in ISQM 1 as the IAASB revises it, rather than freezing Nigerian practice to a fixed 2020 text.

Crucially, none of this is a standard for the Big Four alone. It applies, in the IAASB's own words, to “all firms that perform engagements under the IAASB's international standards.” A two-partner firm in Port Harcourt performing statutory audits of Nigerian private companies that are subject to audit under CAMA (small companies and certain dormant companies carry statutory exemptions) is within its scope just as a multinational network auditing a listed bank is.

The Engine: Objectives → Risks → Responses

Strip away the jargon, and ISQM 1's own risk assessment process asks every firm to run the same three steps.

Step 1 — Set quality objectives. The standard specifies quality objectives across six operational components: governance and leadership; relevant ethical requirements (built on the International Code of Ethics for Professional Accountants); acceptance and continuance of client relationships and engagements; engagement performance; resources (human, technological and intellectual); and information and communication.

Step 2 — Identify and assess quality risks. A quality risk is defined precisely: a risk “that has a reasonable possibility of occurring and individually, or in combination with other risks, adversely affecting the achievement of one or more quality objectives.” The firm has to actually think about what could go wrong in its practice — not a generic list borrowed from a manual.

Step 3 — Design and implement responses. Policies and procedures built to address the specific risks identified — not a template copied from a firm three times its size.

The three-step sequence above describes component (a), the firm's risk assessment process — one of eight components that make up ISQM 1's full architecture, which IFAC describes as operating “in an iterative and integrated manner.” ISQM 1 then specifies quality objectives across components (b)–(g) (the six areas below), while component (h) — monitoring and remediation — provides the feedback mechanism through which deficiencies arising anywhere in the system are identified, evaluated and addressed.

Monitoring works through a specific chain: activities produce findings, and “not all findings will result in a deficiency” — a finding only becomes a deficiency where, for example, a quality objective was never established, a quality risk was missed or misjudged, or a response wasn't designed, implemented, or operating effectively. Once something is identified as a deficiency, the firm must evaluate its severity and pervasiveness, and — specifically — investigate its root cause, since that root cause is what should drive the remedial action chosen.

The Architecture: Eight Components, Not Six

A common misreading of ISQM 1 stops at the six components carrying explicit quality objectives — leaving the impression that this is the whole standard. It isn't. Those six sit inside an eight-component system of quality management, alongside the firm's risk assessment process (component (a), described above) and the monitoring and remediation process (component (h)). The table below translates the six operational components where quality objectives are set.

This Scales Down — It Doesn't Disappear

The most common misconception about ISQM 1 among small Nigerian practices is that it was written for firms with dozens of partners and doesn't really apply to them. The standard itself says otherwise, explicitly building in proportionality:

• “The quality objectives specified in ISQM 1 are required for all firms and all engagements, unless clearly not applicable. For example, if you are a sole practitioner, you do not need quality objectives related to the direction and supervision of staff.”

• A firm outside any network doesn't need the objectives tied to communication within a network.

• On documentation: “one straightforward document may be adequate to document quality objectives and quality risks and responses” for a small firm, “as compared to a large firm with many partners,” which may need “a more formal and complex manual.”

• On governance: every firm must appoint an individual with ultimate authority for the SoQM and an individual with operational responsibility for it — but “in a small firm, this could be the same person.”

For a less complex practice, a straightforward document or tracking spreadsheet — listing each quality objective, the firm's own circumstances against it, and any risk that emerges — can be an entirely legitimate starting architecture. But proportionality reduces complexity, not the underlying obligation: the firm still has to be able to demonstrate how the system was designed, implemented, operated, monitored and evaluated — not merely that a document exists somewhere.

Where Nigeria Actually Stands

This is the part the earlier article on the FRC's audit register didn't cover, because it's a different regulator's job entirely — and Nigeria's challenge here is not the one a reader might expect. It is not an absent framework. It is the gap between what the framework requires on paper and what has demonstrably been carried out.

On paper, the architecture is unusually specific — considerably more so than “comply with ISQM” alone. Regulation 23(2) sets out criteria the Council's own quality review programme must meet: independence from the firms being reviewed, appropriately qualified reviewers with specific quality-assurance training, conflict-of-interest safeguards in how reviewers are assigned, and a review scope, “supported by adequate testing of selected audit files,” covering “compliance with applicable auditing standards and independence requirements” — reported to extend further, to the quantity and quality of resources devoted to an audit, the fees charged, and the firm's internal quality-control system. This is not merely a check that an ISQM manual exists on file.

Regulation 23(2) prescribes the review cycle itself: annual quality reviews for every audit firm auditing more than 20 Public Interest Entities, all other firms reviewed every three years, and each engagement partner reviewed at least every six years — confirmed independently, in matching terms, by both our own reading of the gazetted Regulations and a separate ICAN practitioner briefing on the Audit Regulations. A further sub-regulation separately empowers the Council to call a special investigation or review of any firm or engagement partner at any time, following an audit failure or a notified breach. Regulation 24 (Delegation Arrangements for Supervisory Tasks) then allocates responsibility for running this programme: the FRC directly reviews auditors of Public Interest Entities itself, while review of non-PIE auditors is delegated to Relevant Professional Bodies — a split independently confirmed by the FRC's own Instrument of Delegation with ICAN, which describes the Council conducting reviews “for professional accountants that audit” PIEs while it “delegate[s] the review of Registered Auditors of non-public interest entities and other entities” to the RPB.

The International Federation of Accountants' own 2026 compliance assessment for Nigeria confirms that ISQM 1 and ISQM 2 “are applicable and effective in Nigeria for firms performing audits and reviews of financial statements and other assurance engagements,” and that both ICAN (since 2009) and ANAN (since 2011) already conduct quality assurance reviews of member firms auditing public and non-public interest entities alike — both self-assessed against the IFAC Statement of Membership Obligation on quality assurance (SMO 1). So the gap IFAC identifies is narrower and more specific than “no one checks”: “the FRC's inspection regime for audits of public interest entities (PIEs) has not yet been fully operationalized across all mandatory audits.” That is why Nigeria's overall quality-assurance framework is rated Partially Adopted at jurisdiction level — not because the law is silent, or because non-PIE firms go unreviewed, but because the FRC's own direct inspection layer for PIE audits specifically has not yet reached full, demonstrated coverage.

The distinction worth holding onto is a three-way one: the law, which is unusually detailed; the delegation machinery built to implement it, which already exists and is running through ICAN and ANAN; and the demonstrated, nationwide coverage of actual PIE inspections, which IFAC's 2026 assessment says has not yet been fully achieved. The FRC's April 2026 audit-register enforcement — the National Register becoming, in the FRC's own words, the authoritative list of firms “legally permitted to operate in Nigeria,” with active monitoring and enforcement to follow — and its August 2026 Audit and Assurance Leadership Summit on integrity, independence and accountability both indicate that gap is a live regulatory priority, not a settled one.

Three Layers of Audit Quality

Put the register and ISQM 1 side by side and a distinction emerges that the headline of this article deliberately trades on. There are really three separate questions in play, each answered by a different part of the assurance architecture. Each layer answers a different question — satisfying one does not, by itself, establish that the requirements of another have been satisfied.

The standard governing Layer 3 is worth naming precisely, and completely. ISA 220 (Revised) deals with the responsibilities of the engagement partner and the engagement team for quality management at the level of one specific audit — distinct from ISQM 1's firm-wide system — but it sits alongside, not instead of, the full body of applicable ISAs that govern whether the audit itself was properly planned, evidenced and concluded (sufficiency of audit evidence, risk assessment, going concern, accounting estimates, and the rest). Where an engagement quality review is required — audits of listed entities, engagements where law or regulation mandates one, or any engagement the firm itself judges warrants one as a risk response — ISQM 2 sets out who may act as reviewer and how that review is performed and documented. Both are described by the IAASB as forming, together with ISQM 1, a single interlocking suite: engagement quality reviews “form part of the firm's system of quality management,” and “regardless of its size, the firm must comply with ISQM 1 and, if applicable, ISQM 2,” while engagement teams performing audits comply with ISA 220 (Revised).

The insight worth sitting with: each layer is evidence about a different question, not a substitute for the layer above or below it. Even a firm with a genuinely strong Layer 2 system does not guarantee Layer 3 on every single engagement — a system of quality management makes good outcomes likely and catchable when they slip, not certain.

Related Reading

Two pieces from our Audit & Assurance and Governance & Internal Controls coverage sit either side of this one: “Is Your Auditor Even Allowed to Sign Your Accounts?” covers the FRC's mandatory National Audit and Assurance Firms Register — Layer 1 above. “₦1.34 Trillion in Audit Lapses: What Would an Auditor-General Find in Your Company?” looks at what happens downstream when an entity's own internal controls fail; a firm's system of quality management is the audit profession's equivalent question turned inward.

What This Means for Your Firm, Today

• Registration, an effective SoQM, and a well-performed individual audit are three separate compliance questions. Professional-body quality-assurance review already reaches firms auditing both PIE and non-PIE clients — but that is not the same as saying every firm's system has actually been tested and found sound.

• Proportionality is a real feature of the standard, not an excuse to skip it. A straightforward document or tracking spreadsheet mapping your firm's objectives, risks and responses is a legitimate, proportionate starting architecture for a small practice — but it has to evidence the full design-to-evaluation cycle, not stand in for it.

• Regulation 23(1), read within the quality-assurance framework established by Regulations 21–24 of the FRC Audit Regulations 2020, expressly requires every auditor and audit firm to implement a quality-management system compliant with ISQM as issued by the IAASB — not just an international standard a firm has voluntarily adopted. The Regulations go further than compliance alone, prescribing the review cycle that is meant to check it. For audit firms, the implication is straightforward: the obligation already exists. The unresolved regulatory question is not whether an SoQM is required, but how consistently the prescribed review architecture is being applied across the profession.

Seven-Question ISQM 1 Readiness Check

• Can you name the person in your firm with ultimate authority for your system of quality management — and the person (possibly the same one) with operational responsibility for it?

• Do you have contemporaneous documentation showing your firm's quality objectives, the quality risks you've identified and assessed, and your responses to them — and how that sits within your firm's complete eight-component system of quality management?

• Has the individual with ultimate responsibility evaluated the SoQM at least annually, documented the conclusion reached, and followed through on any deficiencies identified — not merely “at least once” since 2022?

• Is there a real process — not just a stated policy — for declining or dropping a client or engagement your firm judges too risky?

• Is independence actively monitored on every engagement, or only referenced in an onboarding document nobody revisits?

• When monitoring identifies a deficiency, does your firm investigate its root cause, design appropriate remedial action, and evaluate whether that remediation is effective?

• If ICAN or the FRC asked today, could your firm produce contemporaneous evidence showing how its SoQM was designed, implemented, monitored, remediated and annually evaluated?

A “no” to any of these questions warrants attention. Several “no” answers should prompt a structured review of whether your firm's SoQM has been appropriately designed, implemented, operated and evaluated.

If You Are an Audit Committee, Board or CFO

This article has mostly spoken to audit firms. If you are the one appointing or retaining one, the same architecture gives you a due-diligence checklist that goes well past a registration number: has the firm implemented ISQM 1; when was its SoQM last evaluated, and what did that evaluation conclude; were any deficiencies identified, and what was done about them; does this engagement require an Engagement Quality Review; and does the firm have sufficient personnel, technical resources and industry competence for an audit of your size and complexity? None of these questions substitutes for regulatory inspection — but together they ask far more about audit quality than an FRC registration number alone ever will.

How Joe Adinma & Co. Can Help

Joe Adinma & Co. supports audit and assurance practices in assessing and developing proportionate systems of quality management — including quality objectives, risk identification, responses, monitoring, remediation and documentation — and helps entities relying on an auditor's opinion ask the right questions about the firm behind it.

This article is provided for general information only and does not constitute audit, assurance, or professional advice. Every firm's facts and circumstances differ, and readers should seek advice specific to their own practice or engagement.

Sources

• IAASB, International Standard on Quality Management (ISQM) 1

• IFAC, “Getting Started on the New IAASB Quality Management Standards: An Overview”

• IFAC, Member Compliance Program — Nigeria Country Profile (2026)

• IFAC Knowledge Gateway, “Preparing for the New Quality Management Standards: ISQM 1 Quality Objectives and Quality Risks” (Kirsten S. Albo)

• IFAC Knowledge Gateway, “Preparing for the New Quality Management Standards: ISQM 1 System Evaluation and Monitoring”

• Financial Reporting Council of Nigeria, Audit Regulations 2020 — Regulations 21–24 (Official Gazette No. 18, Vol. 111, S.I. No. 36 of 2024)

• Financial Reporting Council of Nigeria, Instrument of Delegation to ICAN (July 2023)

• ICAN, “FRC Audit Regulations — Implications for Professional Accountants” (practitioner briefing, Jamiu Olakisan)

• Financial Reporting Council of Nigeria, National Register of Audit Firms

• CCS, “The Relationship of ISQM 1 with ISQM 2 and ISA 220 (Revised)”