Can we switch two-factor authentication off for some people?
No. SQMTrove holds independence declarations, complaints, inspection findings and the evaluation of the whole system, so every login needs a code from an authenticator app. A person who loses their phone signs in with a recovery code, and an Owner or firm administrator can reset their two-factor after checking who they are (step 3.9).
We already have a quality manual in Word. Do we have to start again?
No. Create the starter manual and replace the text of each policy with your own (steps 10.1 to 10.3), or write each policy with New policy. Keep your risk assessment's substance too: the guided set-up adds a starter library, and you edit, retire or add risks and responses to match your own assessment (chapter 5).
We are a small practice with two partners. Is SQMTrove too much for us?
ISQM 1 applies to every firm that performs audits or reviews, scaled to its nature and circumstances. Retire the library risks that do not apply, and many registers will simply be short. The required objectives and specified responses cannot be removed, because the standard requires them.
Who can sign the annual evaluation?
Only the person assigned ultimate responsibility for the system in Governance & leadership (ISQM 1.20(a)). Others can prepare it. Once signed, the evaluation and its evidence are locked and fingerprinted (chapter 15).
Our engagement quality reviewer is external and has no login. How do we record the review?
Record the reviewer in the people register as external, appoint them on the engagement's EQR page, and record the completion from their signed review record with the record attached (step 9.10). The completion shows as recorded by you from the reviewer's signed record.
Why did SQMTrove raise a finding we did not enter?
Some findings are automatic: a report dated before the engagement quality review was completed, a file assembled after the firm's limit, a report dated while a consultation or difference of opinion was open, a breach of independence, and a substantiated complaint. Each is evaluated like any other finding (chapter 13).
An FRC inspector wants to look at our system. What do we give them?
Print the inspection pack for the year (chapter 16) and, if they want to look for themselves, add them with the Inspector (read-only) role for the visit (steps 3.11 to 3.14). An inspector cannot change anything or use AI, and what they open is recorded. Remove the login after the visit.
All our seats are in use and we need to add someone. What do we do?
Buy more seats on troveuniverse.com (account page). The new limit reaches SQMTrove shortly afterwards. Removing or switching off a login you no longer need also frees a seat.
Can the ethics partner see who raised an anonymous concern?
No. When Submit anonymously is ticked, SQMTrove does not record the person who raised it anywhere, including the audit trail. For that reason the person cannot follow the concern up in SQMTrove.
Does SQMTrove send our data to an AI service?
Only if the firm switches AI assistance on with its own provider and key (chapter 19). It is off by default. With data minimisation on, client and people names are replaced before sending. Complaints are never sent, and every request is logged.
What happens to changes I make offline if someone else changes the same record?
Your change is not lost: it appears under Changes needing your attention on the Offline page, where you decide what to keep (chapter 20).
We use AuditTrove. Do we need to enter our engagements twice?
No. Switch the AuditTrove link on in both apps (chapter 18). AuditTrove's engagements, reviews, report and assembly dates then arrive in the engagement register, and SQMTrove's policies and restricted list are used in AuditTrove.
Our quality-management year ends on 30 June. Where do we set that?
In Settings → Firm, Evaluation date (step 2.2). The annual evaluation, the CPD year used in its evidence and the reports follow it.
Not answered here? Contact us or chat with us on WhatsApp.