Mark Beardsworth, Sharon Takhar, and Nikara Rangesh discuss the FRC’s audit enforcement reforms in New Law Journal

Their article was published in New Law Journal, 18 September 2026, and can be found here. 

On 1 July 2026, the Financial Reporting Council (FRC) introduced significant reforms to its Audit Enforcement Procedure (AEP) – the framework governing its enforcement action against auditors. The changes introduce new resolution pathways, raise the threshold for formal enforcement, and – critically for companies – alter the dynamics of information-sharing between auditors and audited entities at the earliest stages of any concern. In practice, the reforms increase pressure on auditors to engage early with, and provide disclosures to, the FRC where compliance concerns arise – a risk that companies need to factor into their handling of potential misconduct. Companies should also expect auditors to seek more involvement in, and visibility of, live internal or regulatory investigations. Such requests may complicate the protection of privileged work product related to internal investigations and should therefore be approached carefully and with the benefit of expert advice. We highlight below the downstream consequences for companies, along with key takeaways for in-house counsel, audit committees and boards on navigating privilege and disclosure when handling potential misconduct internally.

Overview of the AEP reforms

The revised AEP introduces three additional pathways for resolving auditor non-compliance, supplementing the existing routes of Constructive Engagement and formal investigation: Published Constructive Engagement, the Accelerated Procedure and the Early Admissions Process.

Published Constructive Engagement applies to low-level, inadvertent breaches with no actual, or limited potential, financial harm, where the firm has shown willingness to remediate, but results in a published outcome for deterrence, transparency or education.

The Accelerated Procedure provides a route to resolution where available information is sufficient for the FRC to reach a determination without formal investigation, and a full investigation would be a disproportionate use of time and resources.
The Early Admissions Process allows respondent firms referred for formal investigation to prepare, with FRC agreement, a Factual Account of relevant events, allowing the FRC to settle, continue investigating, or close the matter without a full-scale investigation.

Alongside these new pathways, the threshold for commencing enforcement has been raised. Previously, the FRC could act where information merely raised "a question of breach". It must now have reasonable grounds to suspect a breach and be satisfied that pursuing action is in the public interest.

Heightened privilege and disclosure risks in the new landscape

The AEP reforms are directed at auditors, but their practical consequences extend well beyond the audit profession. They must also be viewed alongside the recent revisions to the International Standards on Auditing (ISA), particularly ISA 240 (fraud) and 570 (going concern). ISA 240 requires an auditor who suspects fraud to report it to those charged with governance and, where management is implicated, consider reporting outside the entity. ISA 570 requires auditors to evaluate going-concern uncertainty and related disclosures, qualifying their opinion where management’s response is inadequate.

The combined effect is to increase both the regulatory pressure on, and the incentives for, auditors to engage early with the FRC where fraud, misconduct and going-concern issues arise – a risk that companies with active investigations need to factor into their investigation strategy. For audited companies, this is likely to change the way auditors seek access to information during internal investigations, with implications for preserving privilege, managing disclosure of sensitive material and retaining strategic control over engagement with auditors and regulators. The issues discussed below illustrate how these changes may arise in practice.

Waiver of privilege through disclosure to auditors

Generally, legal professional privilege over documents relating to a company’s handling of compliance issues is not waived by limited disclosure to an auditor in the ordinary course of an audit. That position becomes harder to maintain under the reformed AEP, where auditors may seek early and detailed access to investigation materials to manage their own regulatory risk, particularly where disclosure is driven less by the audit process than by the auditor’s own potential exposure. As discussed below, companies must also now consider what happens if an auditor that received material on a limited waiver concludes that it is required, or entitled, to disclose it to the FRC, such that the privilege analysis is no longer solely a matter for the company.

These difficulties may prompt an analysis as to whether common interest privilege could form a basis for sharing privileged material with auditors, on the view that both share an interest in proper financial reporting. That protection, however, is narrow and requires a genuine shared legal interest, not merely a commercial or regulatory one. Where the auditor’s purpose is to manage its own FRC exposure, an argument that its interests align with the company's may be difficult to sustain.

A similar difficulty arises with litigation privilege, which protects documents created for the dominant purpose of actual or contemplated litigation. Investigations prompted by whistleblower reports or accounting irregularities may satisfy that test, but only if structured and documented with that purpose clear from the outset. Practically however, it is often not possible to determine whether litigation is contemplated or not at the early stages of allegations being raised. Where an investigation is instead framed as a governance or compliance exercise, or its outputs are shared broadly – including with auditors – without clear ring-fencing, the dominant purpose test becomes harder to meet.

The difficulties a company may encounter in preventing its auditor from disclosing documents to the FRC were demonstrated by A v B and another [2020] EWHC 1491 (Ch). In that case, the FRC sought disclosure from the auditor, B, of documents belonging to the auditor's client, A, over which A asserted privilege on the basis that the documents had been provided to B on a limited waiver for the purposes of an audit. B disagreed that the documents were privileged. The court held that the auditor must form its own view of whether documents are privileged and can therefore be withheld from the FRC. If it wrongly concludes that a document is not privileged, the court noted that its client's rights were capable of being protected by proceedings against the auditor, including by injunction. The court observed that the auditor has its own interests to protect – both its direct obligation to the FRC to comply with (in B's case) a statutory notice, and because it may wish to ensure that the FRC receives the fullest information which was made available to the auditor.

A v B illustrates how a company may no longer entirely control the privilege analysis once documents are in the auditor's hands. The recourse the court identified – proceedings against the auditor, including by injunction – operates only after the event, once disclosure is imminent or threatened, rather than as a means of controlling the position from the outset. Documenting that analysis as an investigation proceeds is therefore now central to preserving privilege, not an afterthought to be addressed once a dispute arises.

Strategic control of disclosures to regulators

Under the previous regime, a company facing potential fraud or misconduct could generally control the timing and sequence of disclosures to regulators – investigating internally, taking legal advice, and deciding whether and when to self-report, largely without risk that the auditor would independently alert the FRC in the meantime.

That assumption may no longer be safe. Auditors now have stronger incentives and, through ISA 240, clearer obligations to escalate concerns externally at an earlier stage. A company that delays engaging with its auditor – whether to preserve privilege or complete its own investigation– risks losing control of the disclosure process entirely.

Where an auditor discloses to the FRC before the company has itself engaged with the relevant regulator, the company’s ability to claim credit for voluntary self-reporting or early cooperation may be prejudiced. Timing is no longer simply an internal governance question – it is a matter of regulatory strategy requiring early and careful consideration.

Key takeaways for boards, audit committees and in-house counsel

Managing these risks calls for close coordination between the board, the audit committee and in-house counsel. Each has a distinct role– boards carry ultimate responsibility for financial reporting and the wider regulatory relationship, audit committees sit at the interface with the auditor day to day and in-house counsel are usually first to see the privilege and regulatory consequences of how information moves. Several practical considerations cut across all three functions:

• Build privilege in from the outset: Investigation protocols should be designed to preserve privilege from inception, not addressed only once legal risk becomes apparent. In practice, this means investigations prompted by, for example, a whistleblower report or accounting irregularity should be commissioned under legal direction, with terms of reference that make clear, from the start, the purpose of anticipating or responding to litigation or regulatory risk, rather than being framed, after the fact, as a routine compliance exercise.

• Control the limited waiver of privilege: Auditors may request early, detailed visibility over an internal investigation as a condition of providing assurance, but that visibility need not come at the expense of privilege. A protocol distinguishing factual information necessary for the audit opinion from legal analysis and strategy, backed by written confidentiality undertakings where material is shared, allows the audit relationship to function without unnecessary or inadvertent waiver.

• Treat sign-off and regulatory strategy as board-level issues: Auditors under their own obligations to the FRC may delay sign-off where governance concerns appear unresolved, and the decision whether and when to self-report is increasingly one the board must take early, not after an investigation concludes. Clear escalation protocols, flagging matters that could trigger an auditor's own disclosure obligations, help ensure that decision is not made by default.

• Keep investigation and audit workstreams properly ring-fenced: Where an internal investigation runs alongside audit procedures, access to privileged material by an auditor's risk or quality team should be by written request explain the rationale for access. Agreeing the scope and cost of any auditor involvement upfront also helps the company to ensure that what is already a time and resource-intensive process, remains manageable.

• Coordinate disclosure timing across advisers: Decisions about self-reporting to regulators, sharing information with auditors and engaging with the FRC are now interdependent rather than sequential. Engaging external counsel early, particularly given the competing interests of key stakeholders – such as auditors, senior management, regulators and for example, whistleblowers – helps ensure these decisions are taken together rather than in isolation.

• Maintain a contemporaneous record: Every substantive communication with an auditor about a developing issue, including what was shared and for what purpose, should be documented as it happens. That record may provide strong supporting evidence if privilege is challenged later.

The AEP reforms do not impose new legal obligations on companies directly, but they are likely to fundamentally alter the audit relationship, placing pressure on privilege, disclosure and regulatory strategy. Privilege must be considered from the outset, since material generated without a clear legal purpose is what auditors may now seek access to. What is shared with an auditor – and on what terms – is now a question of regulatory strategy rather than administrative housekeeping. Above all, the reforms reward preparedness. Those with robust governance and privilege protocols will be best placed to manage the new landscape without sacrificing either the audit relationship or their legal position.