SQM 1 explained: this guide covers what it means, who it applies to, the step-by-step process, documents required, fees, due dates and penalties in India — so you can stay compliant with confidence and avoid costly mistakes.
The second half of SQM 1 is about proof. It tells a firm how to check that its quality system works, how to deal with deficiencies and their root causes, how to use network services without giving up responsibility, and how the head of the firm concludes each year on the system.
SQM 1, as effective for systems of quality management designed and implemented by 1 April 2025 on a recommendatory basis, has a mandatory date of 1 April 2026 that ICAI deferred. ICAI may revise standards, so check icai.org for the current text. Part 1 covers the first components.
A firm must monitor its system, inspect at least one completed engagement for each engagement partner on a cycle it sets, find the root cause of every deficiency, fix it and check that the fix works. Each year, the person with ultimate responsibility concludes on one of three outcomes and documents the basis. ICAI deferred the mandatory date of SQM 1 and SQM 2 on 31 March 2026 until further announcement, so SQC 1 still applies and SQM 1 is recommendatory.
The monitoring and remediation process (paragraphs 35-47)
The process has two purposes (paragraph 35): to give relevant, reliable and timely information about how the system is designed, implemented and operated, and to remediate deficiencies on time.
Designing monitoring activities
Paragraph 37 says the firm decides the nature, timing and extent of monitoring by considering the reasons behind its risk assessments, the design of its responses, changes to the system, the results of earlier monitoring and whether earlier fixes worked, and other information such as complaints, external inspections and service provider information.
Inspection of completed engagements is part of monitoring (paragraph 38). The firm picks engagements and partners using the paragraph 37 factors, takes account of its other monitoring, and selects at least one completed engagement for each engagement partner on a cycle the firm determines. Unlike SQC 1, SQM 1 does not fix the cycle at three years; the firm sets it. People doing the monitoring need competence, capabilities and time, and objectivity: a member of the engagement team or the engagement quality reviewer must not inspect that engagement (paragraph 39).
From findings to deficiencies
Findings are information, from monitoring or elsewhere, that suggests a deficiency may exist. The firm evaluates findings to decide whether deficiencies exist (paragraph 40). For each deficiency it then evaluates severity and pervasiveness by:
- investigating the root cause, in proportion to the nature and possible severity of the deficiency; and
- assessing the effect of deficiencies, one at a time and together, on the system (paragraph 41).
Remediation
The firm designs remedial actions that answer the root causes (paragraph 42). The person with operational responsibility for monitoring checks that actions are well designed and implemented, and that actions for earlier deficiencies worked (paragraph 43); if not, that person makes sure they are modified until they are effective (paragraph 44).
If findings show that required procedures were omitted on an engagement or that the report may be inappropriate, the firm acts to comply with standards and law and, where the report is inappropriate, considers the consequences and whether to obtain legal advice (paragraph 45).
Communication
Monitoring results go up and out. The person responsible for monitoring tells those with ultimate and operational responsibility for the system what monitoring was done, which deficiencies were found and how severe and pervasive they are, and what remedial actions are planned (paragraph 46). The firm also passes this to engagement teams and others so they can act promptly (paragraph 47).
| Step | What the firm does | Paragraph |
|---|---|---|
| Design | Choose activities based on risk and past results | 36-37 |
| Inspect | At least one completed engagement per partner each cycle | 38 |
| Objectivity | Engagement team members and the quality reviewer cannot inspect their own engagement | 39 |
| Evaluate | Findings to deficiencies, then severity, pervasiveness and root cause | 40-41 |
| Remedy | Actions responsive to root cause, then check they work | 42-44 |
| Report | To firm leadership and to teams | 46-47 |
Network requirements and network services (paragraphs 48-52)
Many Indian firms belong to a network or association. Network requirements are what the network obliges the firm to use or do; network services are resources the firm chooses to use. The firm must understand both and what it must do to implement them (paragraph 48). It remains responsible for its own system and must not let network requirements or services contravene SQM 1.
The firm then decides how they feed into its system and whether they need to be adapted or supplemented (paragraph 49). If the network monitors the firm, the firm considers the effect on its own monitoring and obtains the results promptly (paragraph 50). It also understands the network's monitoring across firms and, at least annually, gets overall results, passes relevant information to teams and considers the effect on its system (paragraph 51). If the firm finds a deficiency in a network requirement or service, it tells the network and remediates its own effect (paragraph 52).
Evaluating the system (paragraphs 53-56)
At least annually, as at a point in time, the person with ultimate responsibility evaluates the system on behalf of the firm (paragraph 53) and concludes one of three outcomes (paragraph 54):
| Conclusion | Meaning |
|---|---|
| (a) | The system gives reasonable assurance that its objectives are being achieved |
| (b) | It does so except for deficiencies with a severe but not pervasive effect |
| (c) | It does not give reasonable assurance that objectives are being achieved |
For (b) or (c) the firm takes prompt action and communicates to engagement teams and to external parties under its own communication policies (paragraph 55). The firm also periodically evaluates the performance of the people with ultimate and operational responsibility, taking the system evaluation into account (paragraph 56). In the recommendatory timetable printed in paragraph 13, the first evaluation falls within one year following 1 April 2025.
Documentation (paragraphs 57-60)
Documentation must support a consistent understanding of the system, consistent operation of responses, and evidence for the annual evaluation (paragraph 57). It includes:
- who holds ultimate and operational responsibility;
- the quality objectives and quality risks;
- a description of the responses and how they address the risks;
- for monitoring, the evidence of activities, evaluation of findings and root causes, remedial actions and communications;
- the basis for the annual conclusion (paragraph 58).
Network matters are documented the same way (paragraph 59). The firm sets a retention period for system documentation long enough to monitor the system, or longer if law requires (paragraph 60).
One line on retention of engagement files
SQM 1's application material says engagement documentation for audits is ordinarily kept for no less than seven years, or another period ICAI specifies, from the date of the engagement report. A footnote explains that ICAI's Council amended the ten years printed in SQC 1 and in SA 230 to seven years in August 2009.
Illustrative example
Rao & Sons, an invented firm with three partners, inspects one completed engagement for each partner in its cycle. The inspection of a retail company audit finds that inventory count notes were not signed off by a reviewer. The firm traces the root cause to a checklist that did not name the reviewer, rather than a one-off lapse. The remedy is a revised checklist and training; six months later a re-check shows sign-offs on three recent files, so the deficiency is closed and reported to the managing partner.
Need help with monitoring records?
If your firm needs templates for inspection files, root cause notes or the annual evaluation record, TaxClue's compliance documentation service can help you put them together. Companies that want their own review records in order can also use our compliance documentation support.
Key takeaways
- Inspect at least one completed engagement per engagement partner on a cycle the firm sets.
- Always look for the root cause before deciding on remediation, then check the remedy works.
- A network does not take responsibility for the firm's system away from the firm.
- The head of the firm concludes annually on one of three outcomes and documents why.
- SQM 1 is recommendatory because ICAI deferred its mandatory date; SQC 1 applies.
Read next
- SQM 1, part 1: the eight components
- SQC 1, part 2: monitoring under the current standard
- SQM 2: engagement quality reviews
Disclaimer: Based on the Standards on Auditing and quality standards issued by the Institute of Chartered Accountants of India, in the versions named in the article, and ICAI's announcement of 31 March 2026 on SQM 1 and SQM 2, as consulted on 3 October 2026. ICAI revises standards from time to time; check the current text and effective dates on icai.org. This article is general information, not legal advice; check the official text before acting.