Transparency report 2021–22

We publish a transparency report to show how we audit and apply our internal practices. The Queensland Audit Office (QAO) is not required to prepare this report, but we do so to provide confidence to parliament, our public sector clients, and the public in the quality of our audits. It demonstrates our commitment to transparency and our determination to continuously improve.

We continue to identify and respond to new and revised regulations, standards, and expectations. The 2021–22 financial year has been characterised by:

• the continued resourcing challenges of a highly competitive labour market
• the use of audit analytics to drive more efficient and effective audit testing   
• evolving quality management requirements for audit practices
• challenges brought about by the COVID-19 pandemic to obtain audit evidence and deliver audits.

Our people are supported by well-designed public sector audit methodologies and technology. In 2022 we performed the first round of file reviews since fully implementing our new audit toolset for financial audits. 

In 2021–22, we began an improvement program to refocus our data and analytical capabilities. We are redesigning the way auditors drive the development of analytical tools to improve their service delivery, while maintaining audit quality.

Our quality review findings identified opportunities to improve how we assess and respond to audit risks. In response, to improve effectiveness and efficiency we have developed new standardised templates and innovative approaches to assess risks and collect audit evidence.

QAO’s most valuable resource is our highly skilled workforce. We provided an average of 70 hours of formal professional development per person for our auditors in 2021–22 to complement on-the-job learning. A focus for us next year will be to improve our on-the-job learning and better link it to career pathways – putting our staff in control of their learning and development. As well as developing individual capabilities, we build teams with the right skills mix to deliver high-quality audits.

Statement on the effectiveness of our quality control system

The audits we deliver are supported by an effective internal quality control system.

This report describes the quality control framework and the controls that enable our staff to perform audits in accordance with the Auditor-General Auditing Standards. Our staff are required to adopt the standards issued by the Australian Auditing and Assurance Standards Board to the extent they are consistent with the requirements of the Auditor-General Act 2009.

The results of our quality control practice and internal quality assurance program provide me with a reasonable basis to conclude that QAO’s system of quality control as described in this transparency report is functioning effectively.

Brendan Worrall
Auditor-General

January 2023

We are the independent auditor for the Queensland public sector and local government entities, accountable to the parliament and the wider community. Our financial audits deliver opinions on the accuracy and reliability of entities’ financial statements. We also deliver performance audits, which examine whether public money is being used well and government is meeting the community's expectations for service delivery.

This transparency report covers our audit quality program for the financial year ended 30 June 2022. Its content is guided by the Corporations Act 2001. The report explains our quality program and results and how we seek to improve our audit and assurance practices, and describes our system of quality control. The report also discusses major changes arising from new quality management standards.

Our quality results and what we learnt

Our audit quality program monitors all financial audits, performance audits and assurance reviews. The results provide the support for our conclusion that our internal quality control system is effective.

Our quality reviews informed us that we need to improve in the following areas:

• assigning appropriate inherent risk ratings to audit assertions
• appropriately testing balances with significant judgements and assumptions
• ensuring we perform tests of controls and tests of detail in accordance with our methodology
• supervising less-experienced staff and reviewing their work in a timely manner.

Our quality frameworks

Our internal systems of quality control were maintained in 2021–22. They underwent refinement as part of the implementation of new Australian quality standards that became mandatory on 15 December 2022.

We have improved training, methodology, and guidance, and will continue to do so. Our audit quality culture is supported by strong leadership and clear frameworks, which align with our values to build skills and capability. While engagement leaders are responsible for quality on their audits, our staff all play a role in ensuring audit quality remains high. Our Quality Management Group, together with our independent members of our Audit and Risk Management Committee and Quality Assurance Sub-Committee, provides support and oversight.

Our annual investment in performing quality reviews of audit engagement files

Our annual investment in performing quality reviews is a significant component of our commitment to audit quality. The results inform us about:

• the quality of the audit engagements our staff and audit service providers undertake
• the nature and cause of common findings and where our audit quality is not meeting expectations.

In turn, this informs our continuous learning and development programs, the support materials and guidance we give to auditors, and how we resource our work. While we have implemented the actions we said we would from our prior year’s transparency report, we know we can always do better.

Our annual quality assurance plan identifies the engagement files selected for review. Our Quality Management Group and Quality Assurance Sub-Committee endorse the plan and the Auditor-General approves it. The file selection process is a matter of judgement, with an emphasis on:

• higher-risk or more complex engagements, or on those where quality issues have recently occurred. Accordingly, it is not appropriate to extrapolate the results across all audits we undertake
• coverage of all QAO engagement leaders and a selection of engaged partners from our audit service provider firms. All engaged partners from our audit service providers are part of a rolling 3-year program.

A greater number of financial audit files are reviewed than performance audit files, reflecting the volume and size of our financial audits relative to our performance audits.

What is the scope of our quality reviews?

Our quality reviews are compliance in nature. They assess whether the audits followed our methodology and were undertaken in accordance with relevant standards. In performing a quality review, the independent reviewer determines whether the engagement team obtained and documented a sufficient and appropriate level of audit evidence to support their judgements, conclusions and the audit opinion, guided by:

• the Auditor-General Auditing Standards (which incorporate the Australian auditing standards)
• other relevant statutory and regulatory frameworks that govern QAO and our clients
• QAO’s audit methodology, policies, and procedures.

Not all audit workpapers in an engagement file are examined by the reviewer. Specific areas of an engagement file that may be reviewed include:

• significant (highest) risks of material misstatement, including key audit matters (if applicable) and areas of audit focus that engagement leaders report in their external audit plans
• areas of focus established in the annual quality assurance plan, which may include material classes of transactions, balances, and disclosures; specific types of audit procedures (such as substantive analytical procedures, tests of control, or tests of detail); and other areas covered in recent training
• evidence to support adequate, effective and timely engagement leader and engagement manager input and review of key judgements and significant matters.

Closed file (post-audit) quality reviews

Open file quality reviews

What are we doing to improve and maintain audit quality?

Reviewing our audit service providers’ systems of quality control

We assess how our audit service providers ensure they comply with the quality control standards expected of audit firms in Australia. We call these 'firm reviews'. The main standards that applied in 2021–22 were:

• Auditing Standard ASQC 1 Quality Control for Firms that Perform Audits and Reviews of Financial Reports and Other Financial Information, Other Assurance Engagements and Related Services Engagements
• the Accounting Professional and Ethical Standards Board's APES 320 Quality Control for Firms.

In 2021–22, we undertook detailed reviews into 4 firms’ systems of quality control as part of a rolling monitoring program. We undertook high-level reviews of 6 other firms that perform audits on our behalf.

Other than one additional detailed review, which is outstanding at the date of this report, we assessed that all firms reviewed have satisfactory systems of quality control in place.

This chapter describes the elements of our quality control system, including:

• our structure to ensure quality audits
• quality risk management
• our audit quality framework.

Our structure to ensure quality audits

The Auditor-General Act 2009 states that the Auditor-General is responsible for all audit work undertaken. The Executive Management Group (EMG), comprising the Auditor-General and Assistant Auditors‑General (AAGs), assumes operational responsibility for our system of quality control.

Our quality control structure is outlined in Figure 2A.

Governance and oversight bodies

Several committees have risk and quality responsibilities for overseeing and influencing our quality outcomes.

The Audit and Risk Management Committee (ARMC) is an independent advisory committee to the Auditor-General, comprising 3 external members, 2 of whom have extensive audit experience in major audit practices. The ARMC provides effective oversight of risk, control, compliance frameworks, and fiscal responsibilities underpinning our corporate governance. It met 4 times in 2021–22, as per the annual plan.

The Quality Assurance Sub-Committee of the ARMC provides external advice, guidance, and challenge regarding our audit quality activities. The sub‑committee has 3 external members, all of whom have extensive experience in audit and audit quality practices. The sub‑committee has access to all relevant information about the application of our audit quality framework and the processes that underpin it, including our quality assurance program. The sub‑committee gives objective feedback and advice on how we can continue to improve the quality of our audits.

The Quality Management Group consists of 3 Assistant Auditors-General (AAGs). The group meets quarterly to oversee completion of the quality assurance plan, consider quality findings, advise on any disputed findings, and determine appropriate action plans.

Complex financial accounting and audit issues are considered by the Technical Issues Panel. This committee includes members of the Executive Management Group (EMG) and is supported by the Senior Director—Audit Practice and the Director—Technical. Members discuss issues before approval by the Assistant Auditor‑General—Audit Practice. We consider actions arising from the committee’s views in our quality program and incorporate them into our training programs.

The Modified Opinions Panel reviews proposed audit qualifications, emphasis of matters and key audit matters reporting. The panel also assesses complex material prior period errors reported in client financial statements. Its assessment includes reviewing a root cause analysis of why the prior period error occurred. This panel consists of the AAGs and is supported by the Senior Director—Audit Practice. Qualifications raised on significant public sector entities are escalated to the Auditor‑General for approval.

Further information about our commitment to audit quality is outlined in Appendix A.

Quality risk management

We promote a culture of risk awareness and consultation.

Audit quality risk is a component of our operational risk register. Our documentation defines risk events, consequences, and risk appetite. It also identifies controls or treatments in place to prevent occurrences and/or minimise consequences. The risk owner assesses the effectiveness of controls and determines any additional treatments required to strengthen existing controls. Risk discussions are a standing agenda item at monthly EMG meetings.

One of the key controls to reduce audit quality risk is promoting a culture of learning from our quality findings. We summarise the common themes from our quality reviews and discuss them with our audit teams and audit service providers. We update our methodologies, toolsets, and training materials annually, after considering the themes and any further root cause analysis.

Experienced staff, who are independent of the engagement, perform the quality reviews.

The performance measures against which our staff are monitored include audit quality. We evaluate all audit staff annually for demonstrating a strong commitment to audit quality and risk management, excellence in client service, development of junior staff, and contribution to broader audit quality initiatives.

Audit quality framework

Throughout 2021–22, our quality assurance framework applied the principles of:

• the Auditing and Assurance Standards Board’s ASQC 1 and ASA 220
• the Accounting Professional and Ethical Standards Board’s APES 320.

Consistent with these standards, we have policies and procedures that promote an internal culture that recognises quality as fundamental to our purpose. We constantly monitor and evaluate it.

Leadership responsibilities for quality

The EMG is responsible for improvements to the quality assurance framework. The Assistant Auditor‑General—Audit Practice is responsible for implementing enhancements to our quality control framework and monitoring against policies and procedures.

Strong leadership and management are critical to audit quality. The EMG sets the tone for this and communicates our commitment to quality. It promotes an internal culture of integrity, independence, and professionalism, and recognises that quality is essential in performing engagements and issuing appropriate reports.

Audit file quality is managed by AAGs and senior directors/directors, who act as engagement leaders. Staff are appointed to these roles based on their audit experience and demonstrated audit ability. They are required to demonstrate an understanding of our policies and procedures and appropriate quality control. We assess and evaluate the competencies of AAGs and senior directors/directors regularly, in line with our performance management framework.

We appoint engagement quality control reviewers (EQCRs) to all high-risk or complex financial audits, assurance reviews, and performance audits. AAGs and, in limited circumstances, senior directors, act as EQCRs. They ensure that audit quality is assessed while the audit is occurring and before we issue opinions and reports. They review the identified significant risks and audit responses, including key audit matters and areas of judgement and estimation. They review written communication to those charged with governance at the client. They also coach and mentor the engagement leader.

Our audit service providers have established quality frameworks that ensure they comply with professional requirements and our quality expectations. We regularly review the application of their frameworks. Professional bodies and regulators also assess their quality frameworks and audit files. QAO managers have oversight of the work performed by our audit service providers. They regularly engage with the audit service providers to monitor audit progression, stakeholder relationships and emerging audit issues.

Exhibit the right values and behaviours

We regularly communicate our expectations about audit quality, independence, objectivity, and professional scepticism at our team meetings and through our internal policies.

Our culture is expressed by our 4 core values, which set our expectations for performance and behaviour. These values enable us to achieve our vision for better public services through the delivery of audits. We regularly reflect on our culture and ensure our staff are living our values.

Build knowledge, skills, and experience

Our training goals

To deliver high-quality audits, we must appoint and train people who can apply their experience, values, and professional judgement to support the conclusions in our audit reports.

We strive to maintain a highly competent workforce able to deliver outstanding service and quality to our clients. To do this, we have developed a detailed understanding of the skills and capabilities that individuals require at certain points in their career, and a structured approach to learning and development.

Skill and competency expectations

Our policy requires that sufficient personnel with the technical competence necessary for the work are appointed to each engagement. All financial audit managers and engagement leaders are required to have CPA/CA ANZ qualifications. We encourage and support all financial, performance and information system auditors in completing postgraduate study, and we offer them paid study time and financial assistance towards course fees.

Financial audit engagement leaders hold qualifications, skills, and experience equivalent to the Australian Securities and Investments Commission’s requirements to be a registered company auditor. The audit service providers we engage are registered company auditors.

Each team assigned to an audit engagement must collectively possess the competencies necessary to complete the engagement. These teams incorporate specialist skills based on the audit risks and complexity. The teams are led by an engagement leader, who is responsible for the delivery of our audit engagements and reports to parliament. Engagement leaders determine the necessary extent of direction, supervision, and review of junior staff.

Training outcomes

All our staff are assessed for technical competence, work experience, and training throughout their engagements. Their capabilities, competence, development, and performance evaluations are managed in accordance with QAO technical competency frameworks and policies.

Our learning and development programs focus on targeted technical and non‑technical topics, and include focus areas for subject matter experts. The courses are offered on‑demand and in 2 formal training blocks each year. The courses reflect the competency frameworks and are intended to:

• provide staff with the right skills at the right time to deliver quality outcomes for clients and rewarding career experiences for our people
• keep staff at the forefront of new developments in the accounting, auditing, and regulatory environment
• embed our quality and risk appetite within our culture and leadership.

We provided an average of 70 hours of formal in-house training per auditor.

In 2021–22, we provided 9,614 hours of formal in-house training to auditors (2020–21: 13,050 hours). This averages to 70 hours per auditor (2020–21: 96 hours per auditor) on a full-time equivalent (FTE) basis. The decrease in hours reflects a return to a more normal program. In 2020–21, we undertook an extensive training program associated with the full implementation of our audit toolset, as well as refresher training on all key aspects of our financial audit methodology.

We expect our audit professionals to maintain their professional memberships and participate in a minimum of 20 hours of continuing professional development (CPD) annually and 120 hours in every 3‑year period. Our audit service providers are members of professional bodies and have the same CPD expectations. Since 2018, QAO has partnered with CPA Australia in its Recognised Employer Program, joining a select group of organisations providing employees with the highest standard in professional development and support.

The training is based on the technical competencies required for each audit role and encompasses:

• current changes to either auditing or accounting standards
• specific areas of audit focus identified from internal or external sources
• internal quality assurance program observations
• using data analytics tools and tailoring them to client operations
• audit methodology, or transformation initiatives.

Graduate support

We have a comprehensive graduate program that builds technical and soft skills. Our graduates receive hands-on experience and extensive training. Mentors are assigned to support each graduate, and we hold monthly graduate forums to ensure that professional development occurs in their critical first year.

On-the-job learning

In addition to the 9,614 hours of formal in-house training, a lot of learning takes place on the job – in fact most of it does. Senior staff provide less-experienced staff with coaching and mentoring. Performance evaluations are done throughout the year and provide an opportunity to deliver feedback to staff about audit quality and to offer further development opportunities. Staff are encouraged to complete targeted training for identified gaps.

We commissioned an external review into our learning and development framework. The review identified several opportunities to improve the way on-the-job learning is delivered. We are planning how to implement the recommendations and will put an improved framework in place for 2023–24.

Experience

We assign engagement leaders and staff to match their experience and skills to our clients’ industries and associated risks.

We identify people with the right skills and experience to deliver on our quality commitments. Our resourcing team forecasts our people requirements and ensures we have sufficient resources available.

Our audit and assurance staff profile is monitored and we believe we have sufficient senior staff involvement in our audits, as shown in the following staff headcount table and reflected in related audit quality indicators in Appendix G.

Our audit service providers are engaged under competitive tender processes. We assess the experience and skills of engagement partners and key team members as part of our assessment of their suitability to conduct audits on our behalf.

Provide support through methodology and technology

We have prepared audit methodologies to guide the work we undertake in financial audits, assurance reviews, and performance audits.

Our risk-based audit methodology has been developed to ensure compliance with the Auditor‑General Auditing Standards (which comply with Australian auditing standards). It requires us to develop an understanding of each client’s business and risks and apply this to the design and execution of our audits. We adapt our audit methodologies to developments in professional standards and to findings from quality reviews.

Our quality reviews evaluate how well our methodology has been applied.

We undertake investigations into matters referred to us by other integrity agencies, elected officials and the community. We have developed policies and detailed procedures to ensure consistency in undertaking these investigations. Our fact sheet on Requests for audits explains how these investigations are undertaken.

During the year, we began a project to redesign how we develop audit analytical tools. These tools aim to use clients’ data in a smarter way to allow audit teams to be more targeted and quicker in their work, while maintaining audit quality. Our technology platforms are also being modernised to ensure they are secure and fit for our purposes.

Our audit methodology and evolving toolset

All financial and performance audits beginning after 1 July 2021 have been documented using our audit toolset – Quest. Quest is an internally developed audit template based on the CaseWare Audit System. This template was co-developed with CaseWare (Australia and New Zealand) and configured to suit Queensland public sector auditing. We took the opportunity during 2021–22 to refine some of our key workpaper templates in Quest to further improve our efficiency and effectiveness in responding to auditing standard requirements.

The Quest toolset enables comprehensive planning, performance, documentation, and review of our work in accordance with auditing standards and applicable professional, regulatory, and legal obligations. It also provides comprehensive content to ensure we structure our audits to comply with the Auditor‑General Auditing Standards and our methodology and guidance. Better practice files have been prepared to guide staff in the level of audit documentation that is expected.

Monitor and act in a timely manner

Our audit approach requires us to plan, supervise, and manage our audits so the work performed provides reasonable assurance they comply with our policies and methodologies. The engagement leader is responsible for:

• the overall management of staff and the audit process
• engagement quality
• ensuring engagement quality control reviewers are promptly briefed on significant matters.

Engagement leaders are required to review all high-risk areas of their audits and to ensure that the audit manager or on-site team leader has performed a timely review of all audit working papers. We have a range of business intelligence reporting that helps engagement leaders to monitor this. We continue to refine these reports to provide even more meaningful insights to engagement leaders. AAGs meet regularly with engagement leaders to provide oversight of audit delivery.

We have established technical support groups to provide in-depth and expert analysis of complex financial accounting and audit issues, reporting of key audit matters, and proposed audit qualifications. These groups meet throughout the audit year as required.

Our open file review program reviews the planning outcomes of our engagement leaders' higher‑risk audits. Its focus is on ensuring the audit planning is in accordance with the Auditor-General Auditing Standards and whether appropriate risk response plans have been developed for public sector-specific matters.

Improvement opportunities

We report improvement opportunities identified from the reviews to the Executive Management Group (EMG), the Quality Management Group (QMG), the Audit and Risk Management Committee, and the Quality Assurance Sub-Committee at the completion of each review cycle.

The themes of the open review and closed review programs, together with improvement recommendations, are shared with all audit staff. Teams are required to acquit in their audit files how they have addressed the recommendations.

Oversight and reporting to leadership

A monthly status update on the progress of the quality assurance plan is provided to the EMG. The QMG actively oversees the quality function and meets quarterly, and as needed, to review quality findings and moderate review outcomes. At the conclusion of the annual cycle, a final report summarising all quality assurance activity for the year is provided to the EMG and QMG.

Review team, milestones, and duration of audit quality program

The Assistant Auditor-General—Audit Practice has overall responsibility for the quality review program and is responsible for quality assurance, active oversight of policies and procedures relating to quality assurance, and the effectiveness of training processes in accordance with QAO’s Learning and Development Plan.

We predominantly use specialist contractors to deliver the quality review program. This helps us maintain the independence of the review function. Internal senior managers and directors assist in undertaking reviews of our audit service providers' files.

We develop an annual quality plan that establishes the files selected for current (open) and post-audit (closed) reviews, areas for deeper analysis, the timing of quality reviews, and reporting milestones. Open file reviews (and most closed file reviews) are completed in time for teams to undertake recommended improvement actions in their current year audit files.

Monitoring audit quality

Monitoring audit quality is an important aspect of identifying emerging risks and opportunities, ensuring standards are being adhered to and that staff are performing well.

We monitor a range of audit quality indicators that span our culture and values, independence, recruitment, employee performance assessment, audit allocation process, quality assurance, timely reporting, and interaction with stakeholders. We monitor both quantitative and qualitative measures, which are reviewed annually for continuing relevance. The measures are listed in Appendix G.

Interact effectively with stakeholders

Engaging with our stakeholders enables us to better align our business and audit practices with our stakeholders’ needs and expectations, helping to drive long-term benefits for QAO and the public sector. We have many stakeholders, but we primarily define them through our reporting products as:

• parliament
• state and local government entities.

We recognise that effective communication between audit teams, client management teams, audit committees, and boards is critical to excellence in financial reporting. Our communication covers the scope of audits, any threats to independence or objectivity, risk assessments, significant findings, and judgements. Our reports are structured to communicate clear and concise messages and allow readers to quickly understand key findings.

We regularly report the progress of audits and our findings to those charged with governance, including management and audit committees. We do this through informal meetings and through formal presentations of our external audit plans, progress updates, and management letters explaining our findings.

Those charged with governance can provide a positive influence on the quality of an audit by demonstrating an active interest in the auditor's work and acting when they do not consider that appropriate quality has been provided.

We also report publicly to parliament on the results of all our audits and the most significant audit issues we identify.

A new quality management approach

A new quality management approach applying to all Australian firms and jurisdictional audit offices took effect from 15 December 2022. The new approach required us to identify and respond to risks to audit quality.

We:

	undertook a gap analysis between our system of quality management and the requirements of the new standards
	identified some areas of improvement in our management and oversight of internally and externally delivered audits
	developed an implementation plan to ensure that the refinements we were required to make were in place by the commencement of the new standard on 15 December 2022
	asked our audit service providers to confirm that they were making adequate progress towards implementing the required systems and processes to be in compliance with ASQM 1 and 2. All firms confirmed they were making suitable progress and expected to be compliant by 15 December. Our cyclical review of our audit service providers’ systems of quality management will focus on their implementation of the new quality standards in 2022–23.