Audit reviews: the process, pitfalls and published themes – how to get the best outcome when faced with an adverse finding

7 October 2020

In our blog series, we have dealt with how the accountancy regulators put their spotlight on audit quality, and how firms should prepare for an audit quality visit from their regulator to ensure that it goes as smoothly as possible.
 

In a previous blog, we set out how the FRC deals with failing audit standards. Although investigations by the FRC under its Audit Enforcement Procedure (AEP) tend to be more high-profile, both the ICAEW and the ACCA also have the ability to initiate an investigation and/or disciplinary proceedings following a finding that significant improvements are required in relation to an audit, or that regulatory action is warranted.

In this blog we consider what potential adverse outcomes might be from an audit review visit; what to do if your firm receives an adverse audit outcome from a regulator; and what steps you can take to maintain your firm’s audit licence, if such events unfold.

A reminder – why audit reviews are conducted

As we discussed in the first blog in our series, audit reviews are conducted to ensure compliance with the Companies Act 2006 which imposes an obligation on Recognised Supervisory Bodies (“RSBs”) (such as the ICAEW and the ACCA) to ensure that company audit work is carried out by registered auditors. By conducting audit reviews, the RSBs ensure those conducting audit work are compliant with regulatory obligations and auditing standards.

What a potential adverse outcome might be – the ICAEW

If you have received a visit from the ICAEW Quality Assurance Department (“the QAD”), the appointed reviewers may identify concerns with your firm’s auditing practices, either in relation to one particular file, or due to its analysis of your firm’s overarching procedures.

If they do, they will alert you to the issues at the closing meeting of the visit. 

You are then allowed 15 business days to respond to the concerns identified. You might be referred to the Audit Registration Committee (“the ARC”) if:

  1. you are unable to respond sufficiently to alleviate the ICAEW’s concerns; or
  2. you are not able to remediate more serious concerns through your response.

If the QAD makes a decision to refer the firm to the ARC, it will prepare a report setting out its concerns and the evidence that demonstrates those concerns. The firm will have an opportunity to provide comments on the report to the ARC before it is submitted.

This can be a very important stage of the process and any response you make needs to be reflective, informative and comprehensive. It should address each and every issue and set out measurable changes for your firm to make in response to the issues.

The ARC has a range of powers which include carrying out further investigations, taking regulatory action in respect of the concerning conduct or referring the conduct to be considered by the Investigating Committee to determine whether disciplinary action is appropriate[1]. If the ARC is not satisfied that you have taken sufficient steps to address the identified issues, or that the issues cannot be remedied, it may take regulatory action.

For registered auditors (firms), this may mean:

  1. imposing restrictions or conditions on the firm’s registration for a period of time, for example having to carry out external hot or cold file reviews with submission of the results in order to monitor your firm’s progress, or being restricted from taking on any new audits without ARC approval;
  2. suspending the firm’s registration; or
  3. withdrawing registration entirely.

On an individual level, the restrictions imposed on the registered auditor can prohibit a specific individual Principal from conducting certain activities, for example the Principal may no longer be a Responsible Individual (RI); or that an employee is generally prohibited from carrying out audits.

The ARC considers matters on the papers: you will not generally be allowed to attend, so it is imperative that any documents you provide, or written representations that you offer, are clear, comprehensive and well-constructed.

If, however, you are unsatisfied with the decision of the ARC, you may be able to apply for a review of its decision; this will be considered by the Review Committee. You will have the opportunity to appear or be represented at the Review Committee. The Review Committee may, however, order an affected party to contribute to the costs of the review, so you should be sure of your review grounds before taking this step.

If you continue to be unhappy with the decision made, there is a route of appeal to an Appeal Committee. An appeal can only be made if grounds of appeal are made out, so it is not a step which is available to all.

 

What a potential adverse outcome might be – the ACCA

Like the ICAEW, following your firm’s visit from the Practice Monitoring Directorate (“PMD”), you will receive a report from the reviewer who conducted your visit. The report details deficiencies identified at the visit and sets out actions the firm must take to comply with the auditing standards. 

Depending on the deficiencies identified, the reviewer may also determine that a further visit is required and suggest a timescale for that visit. The purpose of this second visit is to check your firm has addressed the recommended actions.

This second visit will not however take place if the reviewer is of the opinion that the concerns are serious enough to warrant the individual auditor, the firm or both being referred to the Regulatory Assessor, or to the Admissions and Licensing Committee (“ALC”).

Regardless of the ultimate recipient of the referral, the reviewer is required to prepare a draft report which will be sent to the firm before it is sent to the Assessor or the ALC.

Regulatory Assessor

In cases where concerns are being raised about the firm or an individual principal for the first time, it is likely that there will be a referral to the Regulatory Assessor to determine whether conditions on a certificate or licence are warranted.

Regulatory Assessors can consider all concerns about the standard of a firm’s audit or insolvency work but are limited in the scope of sanction they can impose in their cases. For both individuals and firms, they have the delegated power to impose conditions on a certificate or licence but cannot withdraw the certificate or licence.

If the Regulatory Assessor considers that a removal of a certificate or licence may be warranted, they will refer the case to the ALC.

If you disagree with the Regulatory Assessor’s decision, you can also refer it to the ALC.

Admissions and Licensing Committee (ALC)

In more complex cases, or cases where recurrent conduct is demonstrated, it is likely that the matter will fall to be considered by the ALC. This is because, as we explain below, the ALC has broader powers available to it, including the withdrawal of licences or certificates. The ALC can consider serious cases and impose significant sanctions.

For individuals and firms, the ALC has the power to withdraw, suspend or impose conditions on a practising certificate in cases where the conduct falls significantly below the standards that are expected.  Conditions may include a requirement for audit-qualified principals to be subject to an accelerated monitoring visit, with the cost of the visit to be borne by the firm; or the imposition of a warning that failure to make improvements to comply with auditing standards jeopardises the principal’s and the firm’s audit registration.

Where the ALC has significant concerns about the individual’s or the firm’s ability to satisfy the standards, and has withdrawn a principal’s certificate(s) (which may occur where there has been previous unsatisfactory audit work), the ALC may also impose restrictions on the principal’s ability to reapply for certification. Such restrictions include conditions on the engagement partners requiring them to pass a test of competence and attend a suitable practical CPD course before they are permitted to make any future reapplication for the certification.

Like many regulators, if you disagree with the outcome the ALC imposes, you have a right of appeal to the Appeals Committee which you must make within 21 days of being served with the written statement of reasons from the ALC.[2]  Grounds of appeal are limited to: an error of fact or law; a misinterpretation of the ACCA’s bye-laws or regulations, guidance or technical standards; a failure to take into account existing evidence; new evidence becoming available; or that one or more of the ALC’s orders is disproportionate, unreasonable or unjust because of a serious procedural irregularity.

The appeal rights set out above are not absolute and permission to appeal must be obtained from the Appeals Committee before the substantive appeal is heard. This ensures, in the ACCA’s view, that permission is only granted if the appeal has a real prospect of success. It is therefore crucial to ensure that appeal grounds are properly drafted and established on the basis of any information you provide to the Appeals Committee.

 

How to avoid an adverse outcome

Being the subject of adverse regulatory findings in relation to an audit failure can, at best, be inconvenient and costly. The requirement to have files reviewed regularly by an external agency, whilst reporting back to the regulator on a frequent basis, will undoubtedly put additional strain on any practice. If the regulator exercises its full regulatory powers, the effects could be devastating. Understandably, the implications if a licence is revoked or made subject to conditions can be wide-spread.  Clients may lose faith in the auditor and seek to appoint a new auditor, and employees may wish to leave to disassociate themselves with the concerns raised.

It is imperative that where concerns are raised, the auditor and/or the firm address these comprehensively and in a timely manner. In some cases, legal assistance upon the receipt of initial adverse findings at the review stage can assist not only in helping to respond to points raised, but also in rebutting concerns to demonstrate that they do not reach the relevant thresholds for investigation and/or disciplinary action.

Where concerns are raised by the regulator on completion of its audit review, the way in which the regulator proceeds is likely to be influenced strongly by the approach and attitude of the firm in response to the concerns. Firms should consider undertaking the following steps in order to seek to demonstrate an understanding of the issues raised and a willingness to improve:

  • always respond to concerns within the timeframe set by the regulator;
  • if you are unsure of the regulator’s criticism or concern, clarify this as soon as possible to ensure that any future steps put in place specifically address the criticisms raised;
  • undertake a root cause analysis, to determine how the events which led to the concerns arose;
  • based upon the findings of the root cause analysis, prepare a comprehensive action plan to respond to concerns and identify what changes will be made.  You might wish to consider the following:
    • revision of policies and procedures, which should contain sufficient detail to ensure that the events underlying the criticisms do not recur;
    • the implementation of a comprehensive training programme, to be provided to all relevant members of staff. Often it is helpful to employ an external agency to carry out such training to ensure quality and the sharing of wider experiences;
    • employing additional resources or a reducing the number of clients taken on to ensure consistency with standards for existing clients;
    • providing specific training to audit staff involved in the file(s) which gave rise to the concerns; and
    • monitoring quality of audit staff and RIs and taking steps to address lapses in quality, either through the appraisal process or otherwise. 

 

It is very important that firms respond quickly and decisively to any concerns by a regulator. In the current climate of significant focus being placed upon audit, regulators may be perceived to be taking a more invasive approach to audit reviews. A positive and comprehensive response to any adverse findings is therefore more vital than ever. This may avoid the worst case scenario of the revocation of an audit licence, or the firm or audit staff becoming subject to disciplinary action.

further information

For further information raised in this blog post, please contact a member of our Regulatory team. 

 

About the author

Sophie Bolzonello is an Associate, Australian Qualified, in Kingsley Napley’s Regulatory department.  Sophie specialises in advising regulated professionals on compliance, in investigations and in respect of enforcement action. She also advises regulators on policy, governance, prosecutions and litigation. 

 


[1] Disciplinary action differs to regulatory action in that you can receive a reprimand or fine, have your practising certificate taken away, be excluded from ICAEW membership or have no sanction imposed.  Once disciplinary action is taken, the outcome is notified to the Regulatory Committees to then consider whether regulatory action is required which may include withdrawing the firm’s registration or licence to work in a specific regulated area.

 

[2] See the Guidance for Appeal Hearings available here

Share insightLinkedIn Twitter Facebook Email to a friend Print

Email this page to a friend

We welcome views and opinions about the issues raised in this blog. Should you require specific advice in relation to personal circumstances, please use the form on the contact page.

Leave a comment

You may also be interested in:

Skip to content Home About Us Insights Services Contact Accessibility