Assurance · Tax · Advisory · Corporate · TechnologyPakistan · Gulf · UK · US · Canada+92-51-6138902WhatsAppinfo@mac.org.pk
Talk to a Partner
Talk to a Partner

Why MAC / Quality & regulatory standing

Don't take our word for it. Nobody should.

Independent bodies have examined how this firm works. What they looked at, what they concluded, how quality is managed across every service we provide — and how to check all of it without us.

Professional services are the one purchase where the buyer cannot inspect the goods. You are handed an opinion, a return, a set of accounts — and you find out whether the judgement behind it was sound only when something goes wrong. That asymmetry is why the profession is regulated the way it is, and why this page explains the mechanism rather than displaying the badge.

Talk to a Partner Verify us independently →
  • ICAP Registered
  • AOB Compliant
  • QCR — Satisfactory
  • APRSP — Satisfactory
  • ISQM 1 System of Quality Management
IThe honest map

Which assurance applies to which work

Most firms let four audit badges imply firm-wide oversight. Here is the actual position.

Assurance framework by service line
FrameworkWhat it coversApplies to
ICAP Code of EthicsIntegrity, objectivity, professional competence and due care, confidentiality, professional behaviourEvery engagement we accept — audit, tax, accounting, corporate, advisory, technology, sustainability, Global Delivery
ISQM 1 — System of Quality ManagementGovernance, ethics, acceptance and continuance, engagement performance, resources, information and communication, monitoring and remediationAudits, reviews, and other assurance and related services engagements
Quality Control Review (ICAP)Independent inspection of completed engagement files and the quality management systemAudit practice
APRSP (ICAP)Independent review of audit methodology and documentationAudit practice — completed prior to QCR
Audit Oversight BoardIndependent regulatory oversight outside the profession's own bodyAudits of public interest companies
ISO 27001 · COBIT · NIST · SOC 2Information security, IT governance, controls assuranceTechnology engagements and firm-wide data handling
Engagement-level controlsAcceptance, review, documentation, deadline control, defensibilityEvery service line — set out in section V

We would rather be precise about what our credentials cover than let four audit badges do work they were never designed to do.

IIWhat we hold

Four credentials, explained properly

Not what they are called. What they required.

Institute of Chartered Accountants of PakistanICAP

ICAP Registered

Statutory registration

What it is
The Institute of Chartered Accountants of Pakistan is the statutory body governing the profession, established under the Chartered Accountants Ordinance, 1961. A firm cannot describe itself as a firm of Chartered Accountants, or sign an audit report in Pakistan, without being registered with it.
What it obliges us to do
Maintain the ethical standards of the ICAP Code of Ethics, which follows the IESBA international code. Meet continuing professional development requirements annually. Accept the Institute's disciplinary jurisdiction. Submit to quality monitoring.
What it means for you
There is an authority above us. If we fail you, you have somewhere to go that is not us.
Audit Oversight Board PakistanAOB

AOB Compliant

Independent regulator

What it is
The Audit Oversight Board is Pakistan's independent audit regulator, established under the Securities and Exchange Commission of Pakistan Act. Its creation moved oversight of public interest company audits outside the profession's own hands.
What it obliges us to do
Registration and compliance with AOB requirements for the audit of public interest companies, including inspection by an authority independent of ICAP.
What it means for you
The regulator watching us is not our own trade body. For a listed or public interest entity, this is the credential that matters most.
APRSP

APRSP — Satisfactory

Our first independent review

What it is
The Audit Practice Review and Support Programme was established by ICAP's Council under IFAC's SMO 1 quality assurance obligation and became effective on 1 October 2020. It extends independent monitoring to audit practices not yet within the Quality Control Review programme.
What it examined
Audit methodology, engagement documentation and the firm's quality management arrangements, assessed by a review team appointed by the Institute.
Outcome
Satisfactory
What it means for you
This was our first independent inspection, and it came early in the firm's life. We did not wait to be large enough to be interesting to a regulator.
QCR

QCR — Satisfactory

Our current standing

What it is
ICAP's Quality Control Review programme is a periodic independent inspection of an audit firm's completed engagement files and its quality management system, carried out by reviewers appointed by the Institute's Quality Assurance Board. It is the senior of the two monitoring programmes; a firm brought into it moves out of the APRS population.
What it examined
Completed audit files. Working papers supporting the opinion. Evidence that the audit approach responded to assessed risk. Independence and conflict-check documentation. Whether quality management policies were followed in practice rather than merely written down.
Outcome
Satisfactory
What it means for you
Somebody qualified, appointed by the regulator and owing us nothing, opened our files and concluded the work supported the opinions we signed. The rating is neither permanent nor automatic — it must be maintained through the next review cycle.
IIIThe process

What the reviewers actually did

Most firms state the rating and stop. The process is the credential, so here it is.

01

Selection

Engagements are selected for review by the Institute, not offered by the firm. You do not get to choose which files are examined.

02

File inspection

Reviewers examine completed working papers against the opinion issued: whether risks were properly identified, whether procedures responded to those risks, whether the evidence obtained supports the conclusion reached, and whether the file is documented well enough for an experienced auditor with no prior connection to the engagement to follow the reasoning.

03

System review

Quality management policies are examined — independence procedures, acceptance and continuance, engagement performance, resources and monitoring — together with evidence that they operate in practice.

04

Findings and response

Observations are raised. The firm responds, remediates where required, and the response is assessed.

05

Rating

A rating is issued. Satisfactory is the outcome a firm works toward; it is not a participation award, and it can be withheld.

"Satisfactory" means nothing on its own. It means something once you know what had to happen to earn it.

IVISQM 1

Our System of Quality Management

ISQM 1 replaced ISQC 1. The previous standard asked for quality control policies; the current one requires a firm to identify the risks to quality in its own practice, design responses, and evaluate the system annually.

Risk assessment processQuality objectives set, the risks to achieving them identified against our own client base and resources, and responses designed to those specific risks.
Governance and leadershipThe Managing Partner holds ultimate responsibility for the system. Quality is not delegated to an administrative function.
Relevant ethical requirementsIndependence, objectivity, confidentiality and professional behaviour under the ICAP Code of Ethics, with annual declarations and engagement-level confirmations.
Acceptance and continuanceIndependence threats, our competence, and client integrity assessed before acceptance and reassessed on continuance.
Engagement performanceDirection, supervision and review proportionate to assessed risk, with engagement quality reviews under ISQM 2 where required.
ResourcesHuman, technological and intellectual resources — including the technical competence to perform each engagement and the systems to support it.
Information and communicationQuality-relevant information reaching the people who need it, inside the firm and to clients and third parties.
Monitoring and remediationOngoing monitoring, annual evaluation, root-cause analysis of deficiencies, and remediation with follow-up.

ISQM 1 requires annual evaluation of the system and a conclusion on whether it provides reasonable assurance that quality objectives are being achieved. Under ICAP's May 2025 extension for firms performing only audits of small and medium-sized companies, ISQM 1 became mandatorily effective for this firm from 1 July 2026, and our System of Quality Management is evaluated annually against that framework.

VBeyond audit

Seven controls on every engagement

Section IV is the system the standard requires. This is what it looks like on your file — and it applies to all eleven service lines, not the audit practice alone.

01

We only accept work we can do properly

Competence, independence and client integrity are assessed before we quote. Where the answer to any of the three is unsatisfactory, we decline.

Why it matters

Firms that accept everything are staffed for volume, not judgement. A firm that has turned work down is telling you something about the work it keeps.

02

A partner owns the engagement, by name

A partner or executive director is accountable from scoping to delivery, with a named lead you deal with day to day.

Why it matters

When something needs a decision, you know whose decision it is.

03

Scope is agreed in writing before work begins

Deliverables, timelines, responsibilities, assumptions, exclusions and fees — set out before we start, and re-agreed rather than absorbed silently if they change.

Why it matters

Most disputes in professional services are scope disputes. Almost all are avoidable at the outset and almost none afterwards.

04

Nothing leaves the firm on one person's judgement

Every deliverable is reviewed by a second qualified professional, with significant judgements escalated to partner level. An audit opinion and a monthly management pack alike.

Why it matters

Single-reviewer work is where errors survive. The second reader is the control.

05

Work is documented as though it will be examined

An experienced professional with no prior connection to the engagement should be able to pick up the file and follow the reasoning — what was done, why, what was relied upon, what was concluded.

Why it matters

Files do get examined. Reconstructing reasoning afterwards is expensive and rarely convincing; building it in costs nothing.

06

Deadlines are tracked by system, not by memory

Statutory and contractual deadlines held on compliance calendars per client. Regulatory correspondence logged on receipt, with the response date tracked from day one.

Why it matters

In compliance work, being right late is usually indistinguishable from being wrong.

07

We apply the defensibility test

Could we defend this — to a regulator, an incoming auditor, a tribunal, a buyer's advisers? Anything that fails is reworked, and where the answer a client wants would fail it, we say so.

Why it matters

The control that costs us money, and the only one that reliably saves you any.

The same standard reaches your bookkeeping as reaches a statutory audit. Bookkeeping, after all, is where audit problems are born.

VIThe constraint

Independence, confidentiality and competence

Independence is the only thing that makes an audit opinion worth anything. An auditor with a financial interest in the outcome is a consultant with a signature.

Threats assessed before acceptance

Self-interest, self-review, advocacy, familiarity and intimidation threats evaluated at acceptance and reassessed on continuance. Where a threat cannot be reduced to an acceptable level by safeguards, we decline.

No self-review on audit clients

This is why our IFRS 9 valuation and ECL modelling work is directed primarily at non-audit clients. For public interest entities, material valuations involving significant subjectivity are prohibited to audit clients under the ICAP Code of Ethics, and we apply that boundary rather than testing it.

Conflicts documented at acceptance

Conflict checks performed and recorded when the engagement is taken on, not reconstructed afterwards.

Competence maintained, not assumed

ICAP sets continuing professional development requirements we meet as a condition of registration. Named technical leads carry depth in taxation, IT governance and legal, and our Managing Partner serves as visiting faculty for Taxation and Financial Reporting.

Confidentiality is a professional obligation. We treat it as an engineering problem too.

The ICAP Code of Ethics requires us to keep client information confidential, absolutely and permanently. But a professional duty is a promise, and promises do not stop a compromised laptop. Our IT governance function is led in-house by a specialist holding ISO 27001, COBIT, NIST and SOC 2 credentials with more than fifteen industry certifications.

  • Role-based access control, permissioned per engagement
  • Signed confidentiality undertakings at firm and individual level
  • Controlled workstations with no local client-data storage
  • Encrypted transfer and storage
  • Audit-logged access
  • ISO 27001-aligned information security practices
  • Client data segregation between engagements
  • Obligations surviving the end of the engagement permanently

Turning down work is expensive. Doing it anyway is more expensive, and the cost falls on somebody else. That is the trade we are structured to make.

In practice

Why any of this should matter to you.

Your file will hold

Whether it is an audit opinion, a tax position, a set of accounts or a valuation — if it is challenged by a lender, a regulator, an acquirer or a tax authority, the work behind it was built to survive inspection.

Your board can evidence its diligence

Audit committees are expected to assess auditor quality. A QCR-rated, AOB-compliant, ISQM 1-compliant firm gives them something concrete to minute.

Your international counterparties will recognise the framework

ICAP-adopted standards follow IAASB and IESBA internationally. A UK, US or Gulf counterparty reviewing your auditor's standing will find a framework they recognise.

One firm, one standard

The same ethical framework, acceptance procedures and review discipline apply whether you engage us for a statutory audit or for monthly bookkeeping. You are not buying a different firm depending on the service line.

You will be told things you would rather not hear. Which is the point.

VIIIndependent verification

Check us yourself

Everything on this page can be verified without our involvement, and we would rather you did.

  • 01
    ICAP

    Our registration as a firm of Chartered Accountants can be confirmed directly on the ICAP website.

  • 02
    Audit Oversight Board

    Our AOB registration status can be confirmed directly on the Board's register of audit firms.

  • 03
    QCR & APRSP

    Both are ICAP programmes, and our Satisfactory ratings under each can be confirmed directly with the Institute.

If a firm will not tell you how to check its credentials, that is itself information.

Let's work together

Questions about our standing?

Audit committees and procurement teams are welcome to raise specific questions about our quality framework, independence procedures or review history. A partner will answer them directly.

Talk to a Partner Request our RFP pack →