Mark Beardsworth, Sharon Takhar and Nikara Rangesh analyse the FRC’s revisions to its Audit Enforcement Procedure in Business & Accountancy Daily

Reforms to The Financial Reporting Council’s (FRC) Audit Enforcement Procedure (AEP) became effective at the beginning of July.  Via three new pathways, they raise the threshold for commencing enforcement, forming part of a philosophical shift by the regulator towards early engagement and faster resolution. When concerns arise (through a whistleblower report, awareness of potential misconduct, or a new internal investigation), the reforms make it more likely that auditors engage earlier with the FRC.

Important considerations arise for companies about whether, when and how to self-report issues to regulators. In practice, two key risks emerge:

• In fraud, misconduct or going-concern issues, auditors face increased regulatory pressure and greater incentives to disclose to the FRC, which companies with active investigations must factor into their strategy.
• Companies should anticipate auditors seeking fuller disclosures and updates on live internal or regulatory investigations. Careful handling is needed including expert advice to protect privileged work product.

Key AEP changes and practical steps to consider are outlined below.

Additional pathways

The three additional pathways aim to resolve auditor non-compliance: Published Constructive Engagement (PCE), Accelerated Procedure (AP), and Early Admissions Process (EAP). These equip the FRC with more enforcement tools, allowing a response that is proportionate to the severity of the conduct while encouraging earlier engagement and resolution.

Previously, the gap between confidential supervisory action and formal enforcement often resulted in protracted, resource-intensive investigations. The revisions aim to bridge that gap.

Published Constructive Engagement

Like Constructive Engagement, PCE applies where suspected breaches are low-level or inadvertent, involving either no or limited potential financial harm, and the firm has shown a willingness to remediate.  Critically, PCE delivers deterrence, transparency and education.

Accelerated Procedure

Intended for quick efficient resolution of appropriate cases, the AP offers an alternative to formal investigation with available information sufficient for the FRC to determine whether a breach has occurred.

Early Admissions Process

Subject to FRC agreement, respondent firms referred for formal investigation may prepare a Factual Account of events which enables the FRC to decide whether to pursue settlement, continue investigating, or close the matter.

Higher threshold

Whereas the FRC could previously act where information raised a question of breach, the revised AEP raises the threshold for commencing enforcement action. Before pursuing action, reasonable grounds are now required to suspect a breach and the FRC must be satisfied that this is in the public interest.

Audited companies: impact

The AEP reforms follow recent changes to the International Standards on Auditing (ISA) – specifically, to ISA 240 (fraud) and ISA 570 (going concern). Under ISA 240, auditors who suspect fraud must report it to those charged with governance and, if management is implicated, consider external reporting. ISA 570 requires auditors to evaluate going-concern uncertainty and related disclosures, qualifying their opinion when management response is inadequate.

In tandem, these developments increase regulatory expectations and practical incentives for auditors to identify, investigate and escalate concerns earlier. Where appropriate, these include considering disclosure to the FRC when fraud, misconduct or going-concern issues arise. Companies with active investigations need to integrate this risk throughout their investigation strategy.

Audited entities face increased pressure to apply robust governance and escalation processes: to avoid circumstances where an auditor applies pressure that cannot be satisfied with timely information, or decides that external reporting or FRC engagement is appropriate. This provides auditors with regulatory and practical incentives to escalate concerns earlier, instead of allowing management more time to investigate internally.

Historically, companies maintained control over how concerns are identified and internal investigations are handled – including timeframes, personnel and who had access to findings – and updated the auditor when appropriate. But facing pressure to coordinate with the FRC, auditors may be less willing to wait for the conclusion of a client's investigation before forming a view.

Auditors may also seek greater visibility over, or sometimes direct involvement in, handling relevant concerns or internal investigations rather than relying on periodic management updates. Companies must carefully consider how information is shared. Although auditors may seek greater visibility of how relevant issues are handled, companies will still need to preserve legal privilege, protecting litigation and regulatory strategy, and avoiding unnecessary waiver.

Key company takeaways

The revised AEP increases pressure when fraud, misconduct or going-concern issues arise. Companies should therefore consider:

• Robust governance and escalation processes. Before approving a company’s accounts, auditors often seek assurance that fraud, misconduct or going-concern issues have been investigated and addressed. Sign-off may be delayed when assurance cannot be given. To address concerns promptly, support constructive auditor engagement and demonstrate rigour to the FRC, and ensure that governance and investigation processes are sufficiently robust.
• Increased auditor involvement. Rather than awaiting management updates, auditors may seek direct involvement (or more visibility), in a client’s internal investigation or fact-finding exercise. Practical challenges might arise during investigations: preserving legal privilege can become harder, and costs may rise since companies typically pay for the involvement of an auditor’s risk team. To preserve adequate protection, requests need careful consideration, potentially including expert advice.
• Rethinking communication with the auditor. Early on, companies should consider how and when concerns or allegations are communicated: the reforms mean that decisions about timing may now have broader regulatory implications.
• Protecting the self-disclosure advantage. Having generally controlled the timing of self-disclosure to a regulator, companies must be aware that their auditor can now disclose first and should move decisively to avoid losing control of the process. Although the outcome depends on individual regulators, they should also consider whether delaying engagement with their auditor could prejudice any credit due for voluntary self-reporting or early cooperation.
• Planning regulatory strategy. When fraud, misconduct or going-concern issues arise, companies should immediately consider how to harmonise communication with auditors, regulators and legal advisers. Previously sequential decisions may now work best in parallel.

Collectively, the reforms do not affect legal obligations, but they do change the environment in which companies manage them: controlling the pace or sequence of engagement with regulators can no longer be assumed. Early coordination with legal advisers and auditors will increasingly determine the orderly, privileged and strategic management of investigations.