StowbillFree ISQM 1 risk register template for small audit firms
Under ISQM 1, your firm identifies quality risks for each quality objective and designs responses to them. This register gives you the structure and a set of example risks typical of small and mid-size firms, ready to adapt.
What's in the template
- Columns for component, quality risk, likelihood, impact, response, owner, frequency, status and evidence.
- 13 example risks with suggested responses across the ISQM 1 components.
- Empty rows for components where you'll add your own risks.
Example risks
| Component | Quality risk | Example response |
|---|---|---|
| Governance and leadership | Commercial pressure leads partners to accept fee-driven deadlines that compromise quality | Partner review of fee and deadline realism at acceptance; quality is a factor in partner evaluation |
| Relevant ethical requirements | Staff hold financial interests in audit clients without declaring them | Annual independence confirmation by every person; engagement-level confirmation before work starts |
| Relevant ethical requirements | Long association of a partner with a listed client | Rotation tracking for listed and public interest clients |
| Acceptance and continuance | A client is accepted without assessing management integrity | Partner-confirmed acceptance and risk rating required before planning can start |
| Acceptance and continuance | The firm accepts work it lacks the competence or time to perform | Resource and competence check at acceptance; partner sign-off |
| Engagement performance | Working papers are signed off without review | Reviewer sign-off required on each paper; preparer cannot review own work |
| Engagement performance | Review notes remain open when the report is signed | Open review notes block stage moves and reviewer sign-off |
Making it your own
- Tailor risks to your firm's size, clients and services. A sole practitioner's risks differ from a 50-person firm's.
- Assign an owner and a frequency to every response.
- Record evidence that each response operates, such as confirmations, review logs or monitoring results.
- Review the register at least annually, and when monitoring finds a deficiency.
Download the template
Questions
Is this enough to comply with ISQM 1?
No. It's a starting point. ISQM 1 requires your firm to design, implement and operate its own system, and to evaluate it annually.
Can I keep this in Stowbill instead?
Yes. Stowbill's quality module holds the register, monitoring, deficiencies and the annual evaluation, and links them to engagement evidence.
Last reviewed 27 October 2026. General information, not professional or legal advice.
Related
ISQM 1 software for small and mid-size audit firms
ISQM 1 software for small and mid-size audit firms: quality objectives, risk register, monitoring, deficiencie…
SolutionsAudit software built for chartered accountancy firms in Pakistan
Audit software for chartered accountancy firms in Pakistan: ICAP-aligned statutory audit checklist, ISQM 1, cl…
SolutionsAudit software for audit firms in the UAE
Audit software for firms in Dubai, Abu Dhabi and across the UAE: ISQM 1 evidence, client document portal, e-si…
Run your next audit in Stowbill
Start a 30-day trial, or let us walk your partners through a live engagement.