ASQM 1 Audit Quality Management in Australia 2026: What Businesses Must Know When Choosing an Auditor

Choosing an auditor in Australia has always required careful consideration of qualifications, independence, and sector expertise. In 2026, there is an additional dimension that businesses and boards should understand: the quality management framework that governs how audit firms design, operate, and continuously improve their audit processes. The Australian Standard on Quality Management 1 (ASQM 1), adopted by the Auditing and Assurance Standards Board (AUASB), has fundamentally changed what a well-run audit firm looks like — and what you should expect from yours.

Understanding ASQM 1 and the Shift to Risk-Based Quality Management

ASQM 1 is Australia's adoption of the international standard ISQM 1, which replaced the previous quality control standard (ISQC 1) with effect from December 2022. The standard requires every audit firm performing audits, reviews, or other assurance engagements to design, implement, and operate a System of Quality Management (SOQM) tailored to the firm's specific nature, size, and the engagements it performs.

The fundamental shift under ASQM 1 is from a compliance-based, checklist approach to a proactive, risk-based model. Rather than simply following prescribed procedures, firms must now identify the quality risks specific to their practice, design responses proportionate to those risks, and continuously monitor whether their system is working effectively.

This matters for businesses because it means the quality of an audit is no longer solely dependent on the individual auditor assigned to your engagement. It is now a firm-wide responsibility, embedded in governance structures, resource allocation, training programmes, and monitoring processes that the firm's leadership must evaluate annually.

The Eight Components of a Quality Management System

ASQM 1 requires audit firms to address eight interconnected components in their quality management system. Understanding these components helps businesses assess whether their auditor's firm has a genuinely robust quality culture.

Risk Assessment Process

The firm must establish a process to identify and assess quality risks — the risks that the firm's engagements will not achieve their objectives. This includes risks arising from the nature of the firm's clients, the complexity of engagements, and the firm's own capabilities. The risk assessment must be dynamic, updated as circumstances change.

Governance and Leadership

Leadership accountability is a cornerstone of ASQM 1. The standard requires that individuals with ultimate responsibility for the firm's quality management system — typically senior partners or the managing partner — conduct an annual evaluation of the system's effectiveness. This elevates quality management from a back-office function to a board-level responsibility.

Relevant Ethical Requirements

The system must include policies and procedures to ensure compliance with ethical requirements, including independence obligations under the APES 110 Code of Ethics for Professional Accountants and the Corporations Act 2001. For businesses, this means your auditor's firm should have robust processes for identifying and managing independence threats — not just relying on individual auditors to self-assess.

Acceptance and Continuance of Client Relationships

Firms must have processes to assess whether to accept new clients and whether to continue existing relationships. This includes evaluating the integrity of management, the firm's competence to perform the engagement, and whether the engagement can be completed in compliance with professional standards. A firm that accepts every engagement without rigorous assessment is a quality risk.

Engagement Performance

The system must support consistent, high-quality engagement performance. This includes supervision and review processes, consultation mechanisms for complex or contentious issues, and engagement quality reviews for specified engagements. Businesses should ask their auditor how complex accounting judgements are reviewed and who has oversight of the engagement team.

Resources

Firms must ensure they have the human, technological, and intellectual resources needed to perform quality engagements. This includes competency development, technology infrastructure, and access to specialist expertise. Resource constraints are a known driver of audit quality deficiencies — a firm that is understaffed or lacks sector expertise in your industry is a risk.

Information and Communication

The system must support effective communication of quality-related information within the firm and with external parties. This includes communicating quality expectations to engagement teams, sharing lessons learned from quality reviews, and maintaining appropriate documentation.

Monitoring and Remediation

Perhaps the most important component for businesses to understand is the monitoring and remediation process. Firms must conduct ongoing monitoring of their quality management system, including periodic inspection of completed engagements. When deficiencies are identified, the firm must perform root cause analysis and implement remediation actions.

Root Cause Analysis: The Engine of Continuous Improvement

ASIC's thematic reviews of Australia's largest audit firms have consistently identified root cause analysis (RCA) as a critical differentiator between firms that genuinely improve audit quality and those that merely respond to findings superficially. ASIC has found that effective RCA goes beyond identifying what went wrong to understand why it went wrong — and then implementing structural changes to prevent recurrence.

The most common root causes of audit quality deficiencies identified by ASIC across Australia's major firms include insufficient professional scepticism, skill deficiencies in complex areas, and auditor mindset issues where commercial pressures override rigorous verification. Firms that address these root causes through targeted training, supervision changes, and partner accountability mechanisms demonstrate a genuine commitment to quality.

When evaluating an auditor, businesses should ask whether the firm conducts both specific RCA (for individual significant findings) and thematic RCA (to identify systemic patterns across multiple engagements). Firms that only respond to individual findings without looking for systemic issues are likely to see the same problems recur.

ASIC's Audit Surveillance Programme and What It Means for You

ASIC operates an active audit surveillance programme that reviews completed audit files from registered company auditors. For 2026-27, ASIC has expanded its programme to review 25 audit files, covering listed entities, unlisted companies, registrable superannuation entities, and managed investment schemes.

ASIC's surveillance focuses on whether auditors obtained sufficient appropriate evidence to support their conclusions, whether independence obligations were met, and whether professional scepticism was genuinely applied. When ASIC identifies deficiencies, it communicates findings directly to company directors and audit committees under Regulatory Guide 260 (RG 260) — meaning audit quality issues can surface at board level.

For 2026-27, ASIC has flagged specific focus areas including revenue recognition, asset impairment, financial instrument measurement, and sustainability reporting assurance. Businesses in sectors where these issues are material should ensure their auditor has demonstrated competence in these areas and that the firm's quality management system addresses the associated risks.

Sustainability Assurance: A New Quality Management Frontier

The introduction of mandatory climate-related financial disclosures for large Australian entities has created a new quality management challenge for audit firms. The AUASB's ASSA 5000 standard governs sustainability assurance engagements, and ASIC is actively engaging with large audit firms regarding their assurance methodologies for Group 1 entities.

Firms performing sustainability assurance must extend their quality management systems to cover this new engagement type. This includes ensuring auditors have the competence to assess climate-related disclosures, that appropriate specialist resources are available, and that independence requirements are met. For businesses subject to mandatory sustainability reporting, choosing an auditor whose firm has invested in sustainability assurance capability is increasingly important.

Australian Regulatory Context: AUASB, ASIC, and APESB

Audit quality in Australia is governed by an interlocking framework of standards and regulators. The AUASB sets auditing and quality management standards, including ASQM 1, ASQM 2 (Engagement Quality Reviews), and ASA 220 (Revised) which governs quality management at the engagement level. The Accounting Professional and Ethical Standards Board (APESB) sets the ethical framework through APES 110, including independence requirements. ASIC enforces compliance through its surveillance programme and has powers to take action against auditors who fail to meet professional standards.

Registered Company Auditors (RCAs) must be registered with ASIC and meet ongoing competency and independence requirements. ASIC can suspend or cancel an auditor's registration for serious breaches. Businesses should verify that their auditor holds current RCA registration and has no adverse regulatory history.

The AUASB has also updated ASA 240 (the standard on fraud risk assessment) with revised requirements applying to reporting periods commencing on or after 15 December 2026. This means auditors of 31 December 2026 and later year-end financial reports must apply enhanced fraud risk assessment procedures, including more rigorous professional scepticism requirements.

Questions to Ask When Choosing an Auditor in 2026

Armed with an understanding of ASQM 1 and ASIC's quality expectations, businesses can ask more informed questions when selecting or reviewing their auditor.

• Does the firm have a documented System of Quality Management under ASQM 1? Ask to understand the key components and how they apply to your engagement.
• Who has ultimate responsibility for quality management at the firm? Leadership accountability is a core ASQM 1 requirement.
• How does the firm conduct root cause analysis of quality findings? Look for evidence of both specific and thematic RCA processes.
• Has the firm been subject to ASIC surveillance, and what were the outcomes? ASIC findings are communicated to audit committees — ask your auditor directly.
• Does the firm have specialist expertise in your industry and in complex areas like revenue recognition or financial instruments? Resource competency is a quality management requirement.
• How does the firm manage independence threats? Ask about the firm's processes for identifying and resolving independence issues before they become problems.
• Does the firm have sustainability assurance capability? If you are subject to mandatory climate reporting, this is increasingly important.
• How are engagement quality reviews conducted for your audit? ASQM 2 requires engagement quality reviews for specified engagements — ask whether yours qualifies.

How MyMoney® Can Help

Selecting an auditor whose firm operates a genuinely robust quality management system requires more than checking credentials. It requires understanding how the firm approaches quality risk, how it responds to deficiencies, and whether it has the specialist expertise your engagement demands.

MyMoney® connects Australian businesses with qualified auditors who meet the highest professional standards, including ASIC registration, ASQM 1 compliance, and sector-specific expertise.

Post a Brief to describe your audit requirements and receive proposals from qualified professionals. Or Browse Auditors on the MyMoney® Marketplace to find specialists with the expertise and quality management credentials your business needs. This article provides general information only and does not constitute professional advice. Consult a qualified auditor for guidance specific to your circumstances.