Independent quality-management and file monitoring
External Monitoring Review Services
Independent Ongoing Policy Monitoring and Completed File Monitoring Reviews that help CPA practices identify, document, and remediate quality-management and engagement-file issues before regulatory follow-up.
A Practical Review of the Controls and Files That Matter
EQC’s External Monitoring Review Services are designed to help practices identify potential compliance gaps before AFRC inspections. The work combines Ongoing Policy Monitoring Review (OPM) for practice-wide quality-management assessment with Completed File Monitoring Review (CFM) for engagement-level audit quality evaluation.
Our reviews draw on practical AFRC inspection experience to focus attention on deficiencies that regulators are likely to pursue, while helping management direct time and resources toward effective, sustainable remediation. The objective is not only to record findings, but to build evidence that the practice has taken appropriate action.
Download the External Monitoring Brochure2027 Practising-Certificate Renewal Readiness
In July 2026, the AFRC advised CPA practices that it will follow up on SQM compliance, including external monitoring reviews, in the 2027 practising-certificate renewal exercise expected in November to December 2026. This includes evidence of both quality-management monitoring and Completed File Monitoring Reviews. Practices should ensure that their monitoring programme, CFM selection, review reports, root-cause analysis, and remediation follow-up are current and available for regulatory review.
The Two Components of a Monitoring Review
Ongoing Policy Monitoring (OPM) Review
An OPM Review evaluates the practice’s quality-management system and implementation of its policies. The review focuses on internal controls including client and engagement acceptance, AML procedures, independence safeguards, engagement-performance monitoring, and the practice’s follow-up of identified deficiencies.
Completed File Monitoring (CFM) Review
A CFM Review examines selected completed audit or assurance files for significant, repetitive, and isolated deficiencies. The work helps the practice identify deficiencies early, understand their causes, and implement recommendations before the same issues appear in a regulatory review.
How Do Monitoring Reviews Work?
The monitoring-review process is designed to be practical and efficient. Required documents and selected files can be submitted to EQC for a desktop review. EQC shares findings for discussion, recommends appropriate follow-up actions, and performs a final assessment before issuing the monitoring report to confirm that the practice has considered and addressed necessary remedial actions.
CFM Reviews do not necessarily need to take place on-site. Practices can provide scanned working-paper files and financial statements for review, and findings can be discussed in a report, by Zoom, or in person. Selected audit files may also be couriered to EQC’s Central office.
Selecting Completed Files for Monitoring
HKSQM 1 requires a CFM Review on an audit or assurance engagement for each practitioner at least once every three years. EQC recommends an annual CFM Review as part of quality assurance and continuous improvement. The number and mix of engagements selected should reflect the number of audit staff, engagement complexity, and the range of potential deficiencies across the practice.
Rotate Across the Practice
- SME-FRS, HKFRS for Private Entities, and HKFRS / IFRS engagements.
- Engagements prepared and reviewed by different employees.
- Highest-fee engagements and regulated entities.
- Files previously reviewed by a monitor reviewer or regulator with significant findings.
- Engagements with modified or disclaimer opinions.
Include Relevant Risk Areas
- Inventories, financial instruments, intangible assets, going concern issues, or impairment risks.
- Group audits with or without external component auditors.
- Newly accepted clients where opening balances require attention.
- Complex revenue-recognition arrangements.
- Public-interest entities, SFC-regulated corporations, or Insurance Authority-regulated brokers, where relevant.
FAQs on Completed File Monitoring
Monitoring is a key part of a practice’s system of quality management. These questions address common operational concerns about CFM Reviews and the use of findings to strengthen a practice before regulatory follow-up.
1. Why are Completed File Monitoring Reviews important?
Human resources are a practice’s greatest assets. Regular health checks of completed engagements prepared and reviewed by audit semi-seniors, seniors, supervisors, and managers help determine whether daily work is being completed efficiently and to the expected standard. A CFM Review can identify significant deficiencies that matter and help the practice address them before they become regulatory findings.
Quality assurance starts with clear communication to employees and subcontractors about audit quality. Monitoring acts as a control point to identify issues, establish follow-up actions, and support sustainable practice improvement.
2. Which audit engagements should be reviewed?
Selection depends on factors such as the number of independent audit employees and the variety of potential deficiencies across engagements. A sizeable HKFRS engagement may be important, but it may not address other risks such as modified opinions, new-client acceptance, or group-audit procedures. A planned rotation should therefore cover different standards, employees, risk profiles, and engagement features over time.
3. Does a CFM Review need to take place on-site?
No. A CFM Review is not necessarily performed on-site. The practice can submit scanned required files for a desktop review, and EQC can present findings in a report, over Zoom, or in person. A selected audit file may also be couriered to EQC’s Central office at 3/F., World Trust Tower, 50 Stanley Street, Central, Hong Kong.
4. What should we submit for a CFM Review?
The practice should provide a scanned copy of the selected audit working-paper file, including professional-clearance letters, engagement letters, client and engagement-acceptance documents, management-signed letters and confirmations, together with the audited financial statements for the selected file.
5. What are the next steps after a CFM Review?
The key next step is to put the recommendations into practice. The practice may consider using Audit Program 4.1 as a structured audit-automation and documentation workflow to help standardise future audit work and support remediation following an external monitoring review. EQC can also provide practical audit training after the review so the practice can address identified areas of deficiency and improve its working practices.
6. Will identified monitoring findings automatically lead to regulatory penalties?
No. It is a common misconception that appointing a monitor reviewer will itself create a regulatory problem. Monitoring is intended to identify and remedy deficiencies. Practice reviewers expect practices to take quality-management seriously, to identify issues, and to evidence timely follow-up rather than leaving deficiencies unresolved.
Prepare Your Monitoring Evidence for 2027 Renewal
Speak with EQC about OPM Reviews, Completed File Monitoring Reviews, CFM selection, remediation follow-up, or quality-management implementation support for your practice.