Kate Gee and Oliver Steeple examine the FRC’s updates to two core UK auditing standards on fraud and going concern, in Thomson Reuters Regulatory Intelligence

The Financial Reporting Council (FRC) has published final revisions to two of the UK's core auditing standards, reinforcing auditors' obligations to address fraud and assess going concern.

These revisions matter to auditors, company boards, directors and insolvency officeholders and, in years to come, will inevitably feature in audit negligence litigation and disputes arising from corporate collapse.

Changes

Following public consultation, and to align with recent IAASB changes to the equivalent International Standards on Auditing (ISAs), the FRC revisions address auditors' responsibilities in two "front-line" standards: ISA (UK) 240, "The Auditor's Responsibilities Relating to Fraud in an Audit of Financial Statements" and ISA (UK) 570 "Going Concern". The revised standards apply to audits of financial statements for periods beginning on or after December 15.

The updates to ISA (UK) 240 clarify and strengthen auditors' responsibilities, enhance fraud risk-assessment procedures, and seek greater transparency in audit reporting by identifying fraud-related material misstatement risks and emphasising professional scepticism.

The updates to ISA (UK) 570 reinforce how auditors assess and report on going concern. They emphasise material uncertainty, adequate disclosure in financial statements, professional scepticism, and management's plans for future actions.

The updated requirements apply to audits of the financial statements of all entities but are particularly salient for public interest entities, including listed companies, banks and insurers.

Why change now?

The revisions land amid sustained stakeholder scrutiny and audit-quality concerns following high-profile corporate failures. Studies suggest that, over the past decade, auditors often failed to flag material uncertainty related to going concern in final audit reports before publicly listed companies collapsed.

In the UK between 2015 and 2019, the collapses and ensuing scandals and controversies surrounding BHS, Carillion and London Capital & Finance are well-known examples, but such events are not confined to the UK, and the IAASB revisions respond to incidents worldwide.

A prominent and recent UK example is Carillion. The group's collapse in January 2018 resulted in protracted parliamentary select committee and FRC investigations and a £1.3 billion claim by the liquidators of Carillion against its former auditor, KPMG. The core allegation in the litigation was that KPMG did not detect that Carillion's financial statements failed to reflect their true position and that KPMG was therefore negligent in the conduct of Carillion's audits between 2014 and 2016.

In February 2023, that claim settled, and later that year, the FRC issued KPMG a (discounted) £21 million fine due to the "number, range, and seriousness" of issues in KPMG's work. The matter remains a touchstone in debates on audit quality and accountability.

Another recent instance is the collapse of NMC Health in April 2020, which resulted in an FRC investigation and a circa £2 billion claim by the administrators against EY. The administrators' claim was discontinued in January shortly before judgment after a lengthy trial.

The claim alleged that EY's audit opinions were an essential part of a fraud perpetrated on the company involving approximately $4 billion in hidden debt and that EY failed to plan or conduct the 2012 to 2018 audits with reasonable skill and care or in accordance with the applicable ISAs, including ISAs 240 and 570.

What are some key implications for audit negligence litigation?

Scope of duty

For auditors, one implication of the revisions is the expansion of the scope of duty and standard of care when it comes to the legal test for establishing negligence. The ISAs are the threshold that auditors must meet when planning and conducting audits. The revisions expand auditors' responsibilities around fraud detection, professional scepticism, and the evaluation and reporting of going concern risks, including the 'true and fair' requirement that financial statements faithfully represent an organisation's financial position — and therefore also expand their duties.

The leading case on the scope of duty, Manchester Building Society v Grant Thornton UK LLP [2021] UKSC 20, which reframed the "SAAMCO cap" analysis by emphasising that an auditor's liability turns on the purpose and scope of the duty, and whether the loss suffered was the fruition of the risk the audit was intended to guard against.

The revisions strengthen the connection between the purpose of the audit and investor protection, thereby increasing the likelihood that losses arising from undisclosed fraud or unreported going concern problems are characterised as falling within the auditor's scope of duty.

Causation

The recent revisions more clearly define the steps that auditors should take in response to fraud indicators and going concern uncertainty, placing greater emphasis on professional scepticism and the identification and communication of material uncertainty. There is a greater focus on causation and the counterfactual.

The changes set a higher benchmark against which courts can assess the "but for" scenario in the event of alleged audit failure, namely, what would have occurred had the audit been conducted in accordance with the applicable standards. The counterfactual will feature more heavily in this analysis — for example, whether a proper fraud investigation or going concern warning in accordance with the revisions would have altered investor, creditor, regulator or director behaviour sufficiently to prevent or reduce the claimant's loss.

There may also be an impact on the assessment of foreseeability and remoteness. By expressly emphasising the risk of fraud and corporate failure, the standards reinforce that investor and creditor losses flowing from undiscovered fraud or unreported going concern weaknesses are potential foreseeable consequences of audit failures, thereby opening the door for arguments that such losses fall within the auditor's assumed responsibility.

Disclosure

Consistent with the above, the revisions also strengthen audit documentation requirements.

ISA (UK) 240 will require auditors to document key elements of their understanding, the sources of information from which that understanding was obtained, and the risk-assessment procedures performed. If fraud or suspected fraud is identified, the auditor will be required to document the results of the audit procedures performed, the significant professional judgements made, and the conclusions reached.

ISA (UK) 570 revisions strengthen written-representation requirements and introduce new going concern requirements for professional judgements made by the auditor.

In a disputes context, disclosure will therefore remain a key battleground. For example, claimants will continue to target audit working papers under Model C of Practice Direction 57AD. It is unlikely, however, that there will be any change to the court's general reluctance to order pre-action disclosure in these cases.

Expanded language

Before December, directors, audit committees, and auditors will need to prepare to operate with the revised standards for day-to-day audits. The strengthened checks concerning fraud and going concern are welcomed, but whether the revisions will help detect severe corporate mismanagement and fraud will depend on a number of factors, including the manner in which auditors adopt them.

The standards do not convert audits into guarantees against fraud or insolvency. The expanded language with regard to fraud detection and going concern resilience may shape judicial and public expectations about what an audit is intended to achieve. In the years to come, one can expect to see parties to litigation arising out of a corporate collapse using these standards to argue what was reasonable at the time and what should have been escalated before a collapse became inevitable.