Can our statutory auditor be the QI reviewer?

Short answer: Yes—if independence is unquestionable. The QI Agreement allows an internal or external reviewer. What’s prohibited is self-review and any same-firm conflict (when the same firm designed, implemented, or operated your QI/FATCA/1042-S processes).

1) What is actually required?

• Independence & objectivity of the reviewer (internal audit or external firm).
• Appendix-aligned scope covering documentation, withholding, and reporting.
• Evidence-based testing: sampling plan, test execution, findings, and an RO certification dossier.

Rule of thumb: the builder/operator cannot be the reviewer.

2) Independence requirements (clear & auditable)

A) No self-review

The reviewer must not evaluate work that they (or their firm) designed, implemented, or operated—e.g., your W-8/W-9 validation rules, coding guides, FATCA/withholding workflows, 1042-S mappings, or any automation/tools used in QI controls.

B) Avoid the “same-firm” conflict

If your statutory auditor’s firm performed QI design/operations, the firm is conflicted for QI review—even if a different team would perform the review.

C) Internal reviewer is allowed—if separated

Internal Audit (or a suitably segregated second line) may perform the review when it’s functionally independent from QI operations, has a documented mandate/method, and gets full evidence access.

3) Typical conflict scenarios (and clean solutions)

4) Mini decision tree (yes/no)

1. Did the potential reviewer’s firm design/implement/operate QI, FATCA, or 1042-S processes?
   Yes → Not permitted. No → proceed.
2. Is the reviewer (team/function) organizationally independent from QI operations?
   No → Not permitted. Yes → proceed.
3. Are method/scope/tests & evidence fully documentable?
   No → Fix method/evidence before starting. Yes → Permitted.

Tip: capture this in a 1–2 page Independence Assessment Memo.

5) How to document independence (checklist)

Place these in your dataroom:

• Engagement acceptance memo (independence confirmed; no prior QI design/ops work).
• Org chart & mandate (for Internal Audit: functional independence).
• Conflict-of-interest declarations (team & firm-wide).
• Scope letter (Appendix-aligned scope, deliverables, sampling approach).
• Independence statement addressing same-firm/self-review explicitly.

Controls to tick:

• [ ] Reviewer’s firm did no QI design/operations for the period in scope
• [ ] Engagement team had no role in building the processes being tested
• [ ] Full access to evidence (docs, payments, 1042-S/1042, logs)
• [ ] Remote fieldwork permitted (or on-site plan agreed)
• [ ] Reporting structure agreed (findings, remediation, dossier, QAAMS attachments)

6) Sample wording (scope & independence)

Independence
“[Firm] confirms that neither [Firm] nor any member of the engagement team has designed, implemented, or operated the Client’s QI/FATCA/1042-S processes or tools during the period under review. No self-review or same-firm conflict exists.”

Scope
“The review will cover documentation, withholding, and reporting (including 1042-S/1042 reconciliation) in line with the QI Agreement appendices. Testing is risk-based across documentation files and payments. Deliverables include a findings register, remediation roadmap, and an RO certification dossier (evidence map + executive memo).”

7) FAQ

Related service & further reading

👉 QI Periodic Review — fixed scope, 6–8 weeks

• QI sampling sizes (docs vs payments): what passes in practice
• Material failure vs event of default — wording & remediation
• QAAMS upload checklist (review report & attachments)