Audit reviews: the process, pitfalls and published themes

16 July 2020

Audit is more in the spotlight than ever.  The financial news pages seem to have a constant stream of stories about corporate collapses, with the inevitable commentary about how the auditor of the collapsed entity is likely to face a regulatory investigation.
 

The accountancy regulators, however, are not only reactionary in their approach.  Auditors and audit firms are all too aware of the ICAEW and its Quality Assurance Department (QAD) visits; the ACCA and its Practice Monitoring Directorate (PMD) reviews and the Financial Reporting Council (FRC) and its Audit Quality Review (AQR) regime.  This blog series examines the process of those reviews, trends in outcomes and what to do should you face an adverse outcome.

The ICAEW identified in its “Audit Monitoring 2019” report that a significant majority of its monitoring reviews showed positive results.  However, in 10% of the audits reviewed, ‘significant improvements’ were required.  There has been an upward trend in audits being rated as such; this is concerning as those audits lead to reports to the Audit Registration Committee (ARC) for further consideration.  As the ARC can withdraw or suspend registration; or (inter alia) impose conditions or restrictions on a registered auditor, this percentage is noteworthy. 

The ACCA’s regime is similar:  one of the PMD visit outcomes is that ‘regulatory action’ is required.  This would involve the firm being referred to a Regulatory Assessor or the Admissions and Licensing Committee, to consider taking regulatory action.   

The ICAEW is due to publish its 2020 report on audit outcomes in the near future.  The FRC has, this week, published its Audit Quality Inspection (AQI) reports, and described that 33% of audits reviewed required more than limited improvements. An analysis of these reports will follow in this blog series. It will be interesting to discover whether the ICAEW’s report will reflect a similar trend.

Audit firms will be cognisant of the importance of quality assurance in their practice and the serious consequences for failures, including the possibility of regulatory action by their disciplinary body.  However, it is worth highlighting that being prepared for an audit review by any of the regulators is vital.  In this three-part series, we will:

  • remind you of the purpose of an audit review, including who can receive a visit, how to prepare, what to expect during the review and what to do following it;
  • give some guidance on what steps to take should one or more of your audits fall within the ‘significant improvements required’, or ‘regulatory action required’ categories, what the potential adverse outcomes might be and what steps you can take to secure your audit licence; and
  • place the spotlight on FRC AQR reviews, how to deal with adverse conclusions and what trends have been observed from the 2020 AQI report.

In this blog, the first in our series, we examine the background to the requirement for ACCA and ICAEW audit reviews, what to expect from them and how best to prepare to try to ensure that your firm receives a favourable outcome.  The FRC processes differ slightly and are applied on a much larger scale and will be considered in our later blog.

Why are audit reviews conducted?

In the UK, the ICAEW and ACCA are both a Recognised Supervisory Body (RSB) under the Companies Act 2006 (“the Act”).  Under the Act, company audit work must be carried out by registered auditors, under the supervision of an RSB.  For the purposes of this blog, we will concentrate on the work of the ICAEW and ACCA; however, the Institute of Chartered Accountants of Scotland (ICAS), and Chartered Accountants Ireland (CAI) also have the same responsibilities to conduct monitoring visits of each firm registered for audit under their regimes.

Each regulator has established its own procedures for carrying out audit reviews.  Timescales vary depending on the level of risk associated with the firm and other factors such as previously identified deficiencies.

ICAEW  – QAD visits

The ICAEW conducts a visit to every firm it regulates at a minimum of once every six years.  Some firms are selected for more frequent visits depending on a number of factors including:

  • the size and complexity of the firm;
  • its RSB-scope audit clients; and
  • the firm’s previous regulatory history.

Preparing for a visit

The ICAEW will notify you of its plan to visit about 12 weeks in advance.  The letter is usually quite detailed and will cover the expected duration and scope of the visit, including the areas of your practice it will examine. 

A week or two before the visit, the ICAEW will telephone to ask if you have any questions and discuss the practicalities for the visit.

There are a number of documents you will need to have to hand for the QAD reviewer.  These are set out in the ICAEW’s Audit – Monitoring visits. Key documents include:

  • gross practice and audit income for the last financial year and estimates for the current financial year;
  • correspondence with the ICAEW about the firm’s audit registration, including the most recent annual return;
  • your Audit Manual and  ISQC1 documentation;
  • a list of current audit clients which shows the name of the Responsible Individual;
  • staff documents including continuing professional development records, staff assessments, and fit and proper forms.

It can be very helpful to look at your most recent audit compliance review to check that any issues identified have been addressed. If they haven’t, you should be prepared to discuss these with the reviewer and demonstrate the actions you have in place to fix the issues.

On a practical level, make sure you have a space allocated to the reviewer for the duration of their visit and credentials to access relevant systems are available.  You should also have staff available who can answer the reviewer’s questions. 

The visit

As we’ve mentioned, the reviewer will need space to work, access to audit systems and staff available to answer questions throughout the visit.

You should be prepared to have the reviewer with you for the day, even if they do not anticipate they’ll be there for that long. 

The visit will start with an opening meeting with your firm’s audit compliance principal which helps the reviewer to understand:

  • the nature of your audit practice;
  • how you operate it; and
  • your approach to achieving audit quality.

The principal should be prepared to raise any specific points on how your firm operates and to ask questions about the ICAEW.  The ICAEW is happy for other staff to join the opening meeting.

The reviewer will select a sample of audit files for review and may cold review files to confirm results from your audit compliance review. They will also look at firm procedures including training and appraisals, indemnity insurance and annual declarations.

Larger firms may find that the reviewer wants to meet with specific role holders including the head of audit, the person responsible for risk management and HR and the ethics principal. 

The visit will end with a closing meeting where the reviewer summarises their findings and the firm has the opportunity to discuss those findings.  You might find that the reviewer makes suggestions or provides guidance about changes to the firm’s practices.  You should use this as an opportunity to discuss any issues the reviewer raises and propose how you will respond to the issues raised to see whether your proposal meets the visitor’s expectations. 

After the visit

The ICAEW asks that all firms respond to their findings in writing within 15 business days of the visit. 

It is very important that you demonstrate measurable actions you will take to respond to any issues identified in the visit. Be concise, careful and ensure you capture any and all issues raised.

If you proposed a response to the reviewer during their visit and upon detailed consideration decide that it is not practical, or it is not going to resolve the issue identified, explain the reason for the change and ensure your alternative response is appropriate.

The ICAEW will consider your written response and either write to you to confirm your visit has been completed satisfactorily or to request additional information to close your visit.

If the visitor identifies significant issues and you are unable to address these in your written response, or the ICAEW is not satisfied you will address them adequately, you can be referred to the Audit Registration Committee (ARC) which can result in further investigations and the possibility of disciplinary action and sanctions.

In particular, following a monitoring visit, the QAD regularly reports firms to the ARC because, despite making positive confirmations on their annual return that they’ve completed an ACR and kept a record, no such reviews were in fact carried out.

We will provide some guidance on how to deal with a referral to the ARC in the next blog in this series.

 

ACCA

Like the ICAEW, the ACCA, through its Practice Monitoring Directorate (PMD), carries out periodical monitoring of firms it has licensed and authorised to carry out auditing. 

The ACCA’s monitoring cycle ranges between two and six years depending on the risk identified for each particular firm.  Low risk firms can expect visits every six years, medium risk firms (newly registered firms) every four years and high risk firms (those with public interest audits) every two years. The frequency of visits can also be increased if any risk factors were identified in previous visits so it is important to keep in mind when projecting when your next monitoring visit will be.  

Preparing for the visit

The ACCA will identify firms for monitoring and agree a monitoring visit within two to eight weeks.  If the ACCA has concerns, it may arrange a visit with less notice.

Once the visit is arranged and a time chosen, the ACCA will send the firm an information sheet explaining what the visit will cover and what the firm should make available for the visit. The documents to have at hand vary depending on the ACCA’s focus and the type of firm they are monitoring, but can include:

  • the Partnership Agreement or Memorandum and Articles of Association;
  • the firm’s PII cover;
  • continuing professional development records;
  • fitness and propriety documentation;
  • the firm’s financial accounts for the previous two financial periods and for the current period to date;
  • a list of audit clients;
  • details of clients regulated by the ABTA, FSA, SRA and other similar bodies; and/ or
  • client files.

A full list of the types of documents you may need to provide can be found in the ACCA’s guidance here.

What to expect at the visit

Like the ICAEW, the ACCA reviewer will carry out an initial interview with the firm principal(s) within the framework of the practice monitoring programme.

The reviewer will then inspect various practice records to confirm eligibility and compliance with the GPRs and the Code of Ethics and Conduct, inspect client files including samples of audits and samples of investment business cases where relevant.

The visit is closed with a final meeting to agree the findings the reviewer has made and recommendations for improvement.  During this meeting, the firm will find out if whether, in the reviewer’s opinion, further action is required.

After the visit

After the visit has been completed, the reviewer will prepare and send a report to the firm.  This report will detail any and all deficiencies identified and set out the actions the firm must take to comply with the auditing standards.

In that report, the reviewer will set out whether it considers a further visit is required and when that will be. 

However, this will not occur if the ACCA is of the view that the findings are such that regulatory action may be necessary, and the firm needs to be referred to the Regulatory Assessor or to the Admissions and Licensing Committee (ALC).  In that case, the firm will receive a draft report and the report will be sent to the Assessor or the ALC. Regulatory Assessors deal with concerns regarding audit or insolvency work standards and have the ability to impose conditions on licences or certificates. If the Regulatory Assessor has such concerns that in their opinion warrant the removal of a licence or certificate, they will refer the case to the ALC. 

 

The next blog in our series

Your visit is complete and you have just received an adverse report from the reviewer.  You are now in the position of the firm being reported to the ARC in ICAEW proceedings, or to the Regulatory Assessor or the ALC if you are regulated by the ACCA.  What do you do now?

Any negative finding in a visit from a regulator can be concerning. It can be easy to have a knee-jerk response and act on a particular issue without considering what wider steps could be put in place to remedy not just the immediate concern, but to ensure that future reviews do not fall into the same category. We understand how difficult receiving an adverse finding can be, and how the potential of having the firm’s audit licence removed can be overwhelming.  The next blog in our series will look at what practical steps you can take on receipt of an adverse inspection report and what you should do to seek to ensure that your firm can continue to practise audit, unencumbered by regulatory intervention.

About the authors

Julie Matheson is a Partner in the Regulatory team, specialising in defending professionals in the financial and legal fields.  She has particular expertise in defending accountants and accountancy firms in regulatory proceedings brought by the FRC, ICAEW and ACCA.

Sophie Bolzonello is an Associate, Australian Qualified, in Kingsley Napley’s Regulatory department.  Sophie specialises in advising regulated professionals on compliance, in investigations and in respect of enforcement action. She also advises regulators on policy, governance, prosecutions and litigation. 

 

Share insightLinkedIn Twitter Facebook Email to a friend Print

Email this page to a friend

We welcome views and opinions about the issues raised in this blog. Should you require specific advice in relation to personal circumstances, please use the form on the contact page.

Leave a comment

You may also be interested in:

Skip to content Home About Us Insights Services Contact Accessibility