Quality management and engagement review for audit firms under NBA standards.
From a static checklist to a risk-driven quality management system under NVKM, with engagement review via NV COS and the VGBA and ViO codes of conduct. One platform for audit firms. With AI built in, built and hosted in the EU.
The challenge
The NVKM transition takes more than a list of responses
With the NVKM (NBA), quality control shifts from a static list of responses to a risk-based quality management system built on ISQM 1 and 2. At the same time, NV COS calls for a structured conformance approach per standard. Existing tools fall short.
A new paradigm
ISQM thinks in objectives, risks and responses, not in checklists. That shift is conceptually hard and demands a different way of recording than most audit firms are used to.
The frameworks are extensive
NVKM and the NV COS standards library (52 standards, 1,300 requirements) contain hundreds of requirements. Tracking them by hand in separate documents is error-prone and time-consuming.
Documents are not a quality system
Word, Excel and shared folders produce an unmanageable whole: versions go missing, rationale cannot be traced and the link between risk and response disappears.
Residual risk stays invisible
Having a response is not the same as covering a risk. Without structured weighting, the residual risk stays unclear, which is exactly the question ISQM puts at the centre.
Engagement reviews need structure
NV COS conformance checks per engagement require a recorded rating per requirement, with evidence and a visible verification status of the source text. Manual tracking does not scale.
Quality is continuous, not a snapshot
ISQM calls for ongoing monitoring, remediation and an annual evaluation. A one-off self-assessment per cycle is not enough. It takes a living system.
Frameworks
Three frameworks for the audit profession
NBA AQUA covers the quality and conduct frameworks that matter to audit firms, each with the scoring method that fits it.
NBA, NVKM
The Nadere voorschriften kwaliteitsmanagement (quality management regulations) for audit firms. The standard itself sits in the Standaarden voor kwaliteitsmanagement, SKM1 (based on ISQM 1) plus the Dutch supplement SKM3N. Eight quality components, risk-based, with the model QMS as a starting point.
NV COS
The assessable standards library for assurance and related engagements. 52 standards, 1,300 requirements, with conformance scoring per requirement (meets / partly / does not) including evidence and gap.
VGBA & ViO
The conduct standards for accountants (VGBA) and the independence rules (ViO): the five fundamental principles and the conceptual framework, assessed with the same scoring lenses as the quality system.
What NBA AQUA offers
Record once, account for multiple frameworks
NBA AQUA models the ISQM paradigm once and applies it to NVKM, NV COS and the codes of conduct, with AI built into the design. An organisation covered by multiple frameworks doesn't fill in the same thing three times.
AI built in, not bolted on
AI helps formulate quality risks and appropriate controls and maps NV COS requirements to your file. Always as a suggestion, the reviewer decides.
Data sovereignty, built in the EU
Built and hosted in the European Union. Data is stored encrypted per organisation and strictly isolated. No US cloud, your data stays yours.
No costly implementation or licences
No tens-of-thousands-euro implementation project, no sky-high annual licence fees. Accessible to teams and organisations of any size.
Built from audit practice
Designed from the practice of quality assessment under NBA standards. The official standards texts are the basis, with a visible verification status per section.
Framework selector
Choose the framework per file: NBA-NVKM, NV COS (52 standards) or the VGBA and ViO codes of conduct. NVKM follows the ISQM foundation; NV COS uses the conformance engine.
Two engines under one roof
An ISQM engine (NVKM: eight components mapped to objectives, risks, controls and monitoring) alongside a conformance engine for the NV COS standards library. VGBA and ViO run on the same scoring lenses.
Three scoring lenses
Per control, switchable: Design/Existence/Operating effectiveness, Maturity 1 to 5, and Risk (likelihood times impact) weighted against control adequacy, down to residual risk.
Anchored in the official source
The full NV COS library (52 standards, 1,300 requirements) and NVKM are verified against the official source (IAASB, NBA, wetten.overheid.nl). No paraphrasing, with a visible verification status.
How it works
From framework to assessment file in six steps
NBA AQUA guides you step by step, from setting up your NVKM quality management system to the file for self-assessment or external review, and the conformance review of individual engagements under NV COS.
Choose your framework
Start a file for NBA-NVKM, NV COS or the conduct standards VGBA/ViO. NVKM follows the ISQM paradigm; NV COS uses the assessable standards library; VGBA and ViO assess the five fundamental principles and the conceptual framework.
Build out the eight quality components (NVKM)
For each component, record your quality objectives, the related quality risks and the responses. The dashboard shows the eight ISQM components and their progress at a glance. You do not start from scratch: the model QMS gives you a curated library of starter responses that pre-fills your assessment.
Assess with the three lenses
Weigh each response on Design/Existence/Operating effectiveness, a maturity level and risk adequacy. The platform calculates the residual risk and rolls it up to a component and overall rating.
Support it with surveys and interviews
Surveys poll the board, management and staff. In an external review, the assessor records observations and an impression per interview topic, linked to the ISQM objectives, in the same file.
Assemble the file
One file, two perspectives: a self-assessment for your own organisation, or a review file with the self-assessment and the assessor's finding side by side. Assessments under several frameworks are linked in one combined file. With one click you also generate the quality manual as a Word document for the review file.
Review engagements against NV COS
Alongside the quality system, you review individual engagements against the NV COS standards library (52 standards, 1,300 requirements): per requirement meets / partly / does not, with evidence, gap and a visible verification status of the source text.
The quality cycle
The ISQM paradigm, from objective to monitoring
NBA AQUA supports the full ISQM cycle, keeping it alive with ongoing monitoring and an annual evaluation, exactly as the NVKM requires.
Quality objectives
For each component, the organisation records which quality objectives apply, the starting point of the system.
Quality risks
Which risks threaten those objectives? Likelihood and impact are made explicit.
Controls
The controls per risk, assessed on design, existence, operating effectiveness and adequacy → residual risk.
Monitoring & evaluation
Ongoing monitoring, remediation of deficiencies and an annual evaluation close the cycle.
External quality review
Ready for the reviewer, without folders full of evidence
The NVKM requires a periodic quality review of the quality management system. NBA AQUA makes your file review-ready and lets the external reviewer work alongside you in the same environment, no documents emailed back and forth.
Reviewer without an account: the external assessor works via a secure link within the review file, without their own licence or installation.
Review findings alongside self-assessment: the reviewer's rating sits per component next to your own assessment, for direct comparison.
Structured interviews: question sets from leadership and management to the quality or compliance officer, with outcomes recorded in the file.
Combined file: multiple frameworks (NVKM + NV COS) in the same review file, so overlapping evidence is only recorded once.
Built and hosted in the EU: every organisation works in its own segregated environment, with a full audit trail.
Review at a glance
Ready for the NVKM implementation?
Request a demo or get in touch for more information about NBA AQUA for your organisation. An IT audit unit? Take a look at NOREA AQUA instead.