SQMTrove user guide

The illustration: Okafor Bello & Co, Chartered Accountants

Who should read what

Every step says who normally does it. Start with chapter 1 (everyone), then read the chapters for your role:

Contents

1. 1. Getting started

   Open SQMTrove from troveuniverse.com, set up two-factor authentication, sign in, recover a forgotten password and find your way round the dashboard.

   17 steps

   1. 1.1 Open SQMTrove from troveuniverse.com
   2. 1.2 Link your authenticator app
   3. 1.3 Save your recovery codes
   4. 1.4 The first dashboard and the menu
   5. 1.5 Sign in with your email and password
   6. 1.6 Choose your own password
   7. 1.7 Enter the code from your app
   8. 1.8 Forgotten your password? Ask for a link
   9. 1.9 Check your email
   10. 1.10 Open the reset email
   11. 1.11 Choose a new password
   12. 1.12 Sign in with the new password
   13. 1.13 The dashboard: what needs you, and how the system stands
   14. 1.14 Components and the heat map
   15. 1.15 Gaps and regulatory deadlines
   16. 1.16 What staff see
   17. 1.17 Notifications

2. 2. Setting up the firm

   Record the firm's details, registration numbers and quality management policies, your own profile, password, signed-in devices and two-factor settings.

   7 steps

   1. 2.1 Record the firm's details
   2. 2.2 Registration numbers and quality management policies
   3. 2.3 High-risk threshold, engagement quality reviews and the Nigerian rules
   4. 2.4 Your own profile
   5. 2.5 Change your password
   6. 2.6 Signed-in devices
   7. 2.7 Your two-factor settings

3. 3. Users, roles and seats

   Add partners and staff with the right roles, understand the permission matrix, create a custom role, give a regulator read-only access, reset two-factor, and manage the seats in your TroveUniverse plan.

   14 steps

   1. 3.1 Add a person
   2. 3.2 Give the temporary password privately
   3. 3.3 The people list
   4. 3.4 Roles and permissions
   5. 3.5 Partner, manager, staff and inspector roles
   6. 3.6 Create a custom role
   7. 3.7 Change a person's role or access
   8. 3.8 Remove a person from the firm
   9. 3.9 Reset a person's two-factor
   10. 3.10 What the person sees after a reset
   11. 3.11 When all seats are in use
   12. 3.12 The seats banner
   13. 3.13 Give a regulator read-only access
   14. 3.14 What an inspector sees

4. 4. Governance and leadership

   Assign ultimate and operational responsibility for the system, record acknowledgements, and evaluate the leaders' performance each year.

   6 steps

   1. 4.1 The four required roles
   2. 4.2 Assign ultimate responsibility
   3. 4.3 Check what is still to resolve
   4. 4.4 Evaluate a leader's performance
   5. 4.5 The leadership evaluations
   6. 4.6 Governance complete

5. 5. The firm's risk assessment process

   Run the guided set-up, assess each quality risk for likelihood and effect with reasons, describe the responses, link risks, responses and objectives, record conditions and changes, and publish versions of the system.

   19 steps

   1. 5.1 Answer the set-up questions
   2. 5.2 Read the library before you add it
   3. 5.3 Find the risks not yet assessed
   4. 5.4 Assess a quality risk
   5. 5.5 Link the risk to objectives, responses and conditions
   6. 5.6 The overview and heat maps
   7. 5.7 The high risks
   8. 5.8 Quality objectives
   9. 5.9 Add a firm objective
   10. 5.10 The specified responses
   11. 5.11 Describe a response
   12. 5.12 Schedule a task that operates a response
   13. 5.13 The traceability matrix
   14. 5.14 The gap list
   15. 5.15 Record a condition, event or change
   16. 5.16 The conditions register
   17. 5.17 Publish a version of the system
   18. 5.18 Versions, and network content
   19. 5.19 Compare a version with now

6. 6. Resources

   Keep the people register, CPD, competence and accreditations, capacity, appraisals, technology, methodology and templates, and service providers.

   12 steps

   1. 6.1 The people register
   2. 6.2 A person's professional details
   3. 6.3 Record your own CPD
   4. 6.4 CPD compliance
   5. 6.5 Competence and accreditations
   6. 6.6 Capacity of partners and reviewers
   7. 6.7 Record an appraisal
   8. 6.8 The appraisals register
   9. 6.9 Technological resources
   10. 6.10 Methodology and templates
   11. 6.11 Service providers and due diligence
   12. 6.12 Due for review

7. 7. Relevant ethical requirements

   Run the annual independence and fit-and-proper campaigns, review exceptions, keep the restricted list, gifts, breaches, threats and safeguards, non-assurance services, fee dependency and rotation.

   17 steps

   1. 7.1 Open the annual campaign
   2. 7.2 Complete a declaration
   3. 7.3 The campaign as the ethics partner sees it
   4. 7.4 Review an exception
   5. 7.5 Record a declaration on someone's behalf
   6. 7.6 Reconcile the population
   7. 7.7 The restricted entity list
   8. 7.8 Record a gift
   9. 7.9 The gifts register
   10. 7.10 Record a breach
   11. 7.11 Communicate and close the breach
   12. 7.12 The breaches register
   13. 7.13 Threats and safeguards
   14. 7.14 A prohibited non-assurance service
   15. 7.15 Non-assurance services
   16. 7.16 Fees and fee dependency
   17. 7.17 Rotation and firm tenure

8. 8. Clients, acceptance and continuance

   Keep the client register with each client's public interest status, record acceptance and continuance decisions, and deal with information that arrives after acceptance.

   8 steps

   1. 8.1 The client register
   2. 8.2 A client's public interest status
   3. 8.3 An acceptance decision for a new client
   4. 8.4 Decide, with independent approval of high risk
   5. 8.5 The decisions register
   6. 8.6 The client register after the decisions
   7. 8.7 Information after acceptance
   8. 8.8 The information-after-acceptance register

9. 9. Engagements and engagement quality reviews

   Keep the engagement register, import earlier engagements from a spreadsheet, appoint and check engagement quality reviewers, perform the review under ISQM 2, and record consultations and differences of opinion.

   15 steps

   1. 9.1 Import engagements from a spreadsheet
   2. 9.2 Check the import result
   3. 9.3 Add an engagement
   4. 9.4 The engagement register
   5. 9.5 Check eligibility and appoint the reviewer
   6. 9.6 The reviewer is appointed
   7. 9.7 Perform and record the review
   8. 9.8 Confirm completion
   9. 9.9 The completed review
   10. 9.10 Record a review by a reviewer without a login
   11. 9.11 A report dated before the review
   12. 9.12 All engagement quality reviews
   13. 9.13 Record a consultation
   14. 9.14 The consultations register
   15. 9.15 Resolve a difference of opinion

10. 10. Information, policies and communication

    Publish the firm's policies manual and collect acknowledgements, keep the communications log and the record of communications with those charged with governance, track regulatory deadlines and draft the transparency report.

    11 steps

    1. 10.1 Start the policies manual
    2. 10.2 The starter policies
    3. 10.3 Edit and publish a policy
    4. 10.4 Acknowledgements
    5. 10.5 Read and acknowledge a policy
    6. 10.6 The communications log
    7. 10.7 Communications with those charged with governance
    8. 10.8 The regulatory calendar
    9. 10.9 A register on its own page
    10. 10.10 Draft the transparency report
    11. 10.11 The rest of the draft

11. 11. Monitoring: plan, activities and inspections

    Approve the monitoring plan, schedule inspections and tests of responses, follow the engagement partner inspection cycle, and inspect engagement files with SQMTrove's checklist.

    7 steps

    1. 11.1 Approve the monitoring plan
    2. 11.2 Add a monitoring activity
    3. 11.3 The activities of the year
    4. 11.4 The partner inspection cycle
    5. 11.5 Inspect an engagement file
    6. 11.6 Grade and complete the inspection
    7. 11.7 The monitoring overview

12. 12. External inspections by the FRC and ICAN

    Record an inspection by the Financial Reporting Council of Nigeria or ICAN, give the inspector read-only access, record the report and turn its findings into monitoring findings.

    5 steps

    1. 12.1 Record an inspection visit
    2. 12.2 Record the report
    3. 12.3 Add each finding
    4. 12.4 The inspections register
    5. 12.5 Keep versions of a file

13. 13. Findings, deficiencies and remediation

    Evaluate every finding, decide whether it is a deficiency, assess severity and pervasiveness, find the root causes, design and test remedial actions, and report to leadership.

    15 steps

    1. 13.1 The findings to evaluate
    2. 13.2 Evaluate a finding
    3. 13.3 Make a deficiency from a finding
    4. 13.4 The deficiency and its findings
    5. 13.5 Evaluate severity and pervasiveness
    6. 13.6 Root cause analysis: five whys
    7. 13.7 Root causes and the fishbone
    8. 13.8 Add a remedial action
    9. 13.9 Actions and communication
    10. 13.10 Test that an action works
    11. 13.11 All remedial actions
    12. 13.12 Close a deficiency
    13. 13.13 The deficiencies register
    14. 13.14 Report to leadership
    15. 13.15 Deficiencies in the report

14. 14. Complaints, allegations and speak-up

    Let anyone raise a concern, anonymously if they wish, and investigate complaints and allegations in a confidential register.

    4 steps

    1. 14.1 Raise a concern
    2. 14.2 What staff see
    3. 14.3 The complaints register
    4. 14.4 Investigate and conclude

15. 15. The annual evaluation of the system

    Prepare the evaluation as at the evaluation date from frozen evidence, conclude on each component and overall under ISQM 1.54, and sign it as the individual with ultimate responsibility.

    10 steps

    1. 15.1 Start the evaluation
    2. 15.2 Choose the evaluation date
    3. 15.3 The evidence
    4. 15.4 Conclude on each component
    5. 15.5 The overall conclusion
    6. 15.6 Actions and communications
    7. 15.7 Sign the evaluation
    8. 15.8 Confirm the signature
    9. 15.9 The signed evaluation
    10. 15.10 The evaluations register

16. 16. Quality indicators, exports and the inspection pack

    Follow the firm's audit quality indicators, export any register to a spreadsheet, and print the inspection-ready pack for the FRC, ICAN or the network.

    6 steps

    1. 16.1 The quality indicators
    2. 16.2 More indicators
    3. 16.3 The inspection pack
    4. 16.4 Monitoring and remediation in the pack
    5. 16.5 The evaluation in the pack
    6. 16.6 Export a register to a spreadsheet

17. 17. Tasks

    Operate the firm's responses through recurring tasks, record the evidence, and let SQMTrove schedule the next one.

    3 steps

    1. 17.1 My tasks
    2. 17.2 Complete a task with evidence
    3. 17.3 The next task is scheduled

18. 18. The AuditTrove link

    Link SQMTrove with AuditTrove so that engagement facts flow into the engagement register, findings and quality indicators, and AuditTrove uses the firm's policies and restricted entity list.

    5 steps

    1. 18.1 The link is off
    2. 18.2 Confirm
    3. 18.3 Linked
    4. 18.4 The archived file arrives
    5. 18.5 The engagement in the register

19. 19. AI assistance (optional)

    Set up AI assistance with the firm's own AI provider, ask questions about ISQM 1 and 2, draft risks, root cause analyses and other text for review, and govern the prompts and usage.

    10 steps

    1. 19.1 AI assistance is off
    2. 19.2 Provider, model and key
    3. 19.3 Limits, minimisation and acknowledgement
    4. 19.4 Ask ISQM
    5. 19.5 Draft risks for an objective
    6. 19.6 Draft a root cause analysis
    7. 19.7 The prompt library
    8. 19.8 Draft a firm version
    9. 19.9 Approve the version
    10. 19.10 The usage log

20. 20. Working offline

    Keep a copy of the firm's registers on a protected device, keep working without a connection, and sync the changes when back online.

    7 steps

    1. 20.1 The firm's offline policy
    2. 20.2 Make a copy on this device
    3. 20.3 Confirm the device is protected
    4. 20.4 The copy on this device
    5. 20.5 Working offline
    6. 20.6 Changes waiting to sync
    7. 20.7 Synced

21. 21. The audit trail

    See who did what and when, filter the trail, and verify that it has not been changed.

    2 steps

    1. 21.1 The audit trail
    2. 21.2 An entry in full

22. 22. Several firms, the partner dashboard and the subscription

    Use one login in several firms, open a client firm from the TroveUniverse partner dashboard, and understand seats and subscription notices.

    8 steps

    1. 22.1 An invitation from another firm
    2. 22.2 Accept or decline
    3. 22.3 Switch between firms
    4. 22.4 Open a firm from the partner dashboard
    5. 22.5 The sign-on in the audit trail
    6. 22.6 A payment is overdue
    7. 22.7 The subscription is suspended
    8. 22.8 The subscription has ended

Also in this guide

• About this manual
• A quality-management year at a glance
• Use cases: where to find what you need
• Roles: who can do what
• ISQM requirements, standards and regulations
• Index of features
• Frequently asked questions
• Glossary