Public Accounts Commission
Oral evidence: NAO Financial Audit Quality 2024-25, HC 1538
Wednesday 3 December 2025
Ordered by the House of Commons to be published on 3 December 2025.
Members present: Clive Efford (Chair); Sir Geoffrey Clifton-Brown; Chris Vince.
Questions 1-22
Witnesses
I: Gareth Davies, Comptroller and Auditor General, National Audit Office; Gaenor Bagley, non-executive director and independent chair of the audit quality board, National Audit Office; Kate Mathers, executive director of financial audit, National Audit Office.
Examination of witnesses
Witnesses: Gareth Davies, Gaenor Bagley and Kate Mathers.
Chair: Welcome to today’s public evidence session. We are here to discuss the NAO’s audit quality. Could you introduce yourselves for the record?
Gareth Davies: Good morning. My name is Gareth Davies. I am the Comptroller and Auditor General at the National Audit Office.
Kate Mathers: Good morning. My name is Kate Mathers. I am the executive director for financial audit at the National Audit Office.
Gaenor Bagley: I am Gaenor Bagley. I am one of the non‑executives on the board; I chair the audit quality board and the audit committee of the NAO board.
Q1 Chair: Good morning and welcome. The FRC has reported a significant improvement in quality at the NAO. Do you agree with the FRC’s findings?
Gareth Davies: Yes. I think our audit quality is improving, after a long programme of investment over several years. That is bearing fruit now in the results that you can see reported from the FRC. It is worth bearing in mind, as I think I said at your last meeting, that the sample sizes are necessarily small, so you cannot extrapolate completely from those to the overall population, but I think it is fair to say that it shows a definite upward trend.
That is supported by our own internal reviews as well. The FRC and our own reviews are saying the same thing, which is that the investment we have made in a new methodology, a new software platform, a lot of training and development for the staff and a lot of work on the culture of the organisation is serving to improve our audit quality.
Q2 Chair: The FRC sample size was seven out of 399 audits. Can we expect a similar ratio going forward, or will it be a bigger sample?
Gareth Davies: It is worth saying a bit more about that sample. It is consistent with the approach that the FRC takes generally to other firms. It is always a small sample of the population to be inspected. These inspections are very significant events. They are full audits in their own right, essentially, and take a lot of time for both the FRC team and ours. They cost quite a lot of money—we spend £330,000 a year on the FRC, which is money well spent, in terms of our improvement journey and the assurance to you on our quality. But because they are so significant in time and cost, we have to be very careful about doing the amount necessary for assurance and improvement, but no more than that.
Given that the House is the key stakeholder for the assurance provided by these inspections, we are obviously very open to the views of the Commission on the sample that we should use. From our point of view, it is absolutely sufficient to give us a clear indication whether our investments are working and whether there are any new areas that need attention. From that point of view, combined with our internal reviews, I think it is fit for purpose. Kate, you might want to add to that.
Kate Mathers: The FRC sample is quite limited. It is not intended to be statistically representative. We also bolster the coverage we get of the work across our service line through our own internal reviews, and that is probably triple the size of a typical sample. Between 20 and 25 accounts will be looked at after they have been completed. We make sure that each of our directors—those are colleagues who are responsible for leading the audits—is sampled regularly every year. Our senior managers are also sampled regularly, on effectively a two-year cycle. We think that that gives us the breadth of coverage we need.
The FRC targets its sample to what it sees as our highest-risk audits in our Companies Act audit work, and into the wider work as well. Ours will be a more representative sample. It gets a good breadth of coverage, so that gives us the information we need.
Chair: So, alongside the FRC, you do your own sampling.
Kate Mathers: That is correct.
Q3 Chair: Does your sampling agree with the FRC’s?
Kate Mathers: At the level of detail, there is a difference. The FRC, in its sample, found all the audits to meet standards. In the equivalent review that we carried out, that figure was just over 70%. That reflects a different level of detail. We are looking at breadth of coverage, so you might expect a different outcome. The key point for me is around the direction of travel. Both those measures show an encouraging trajectory. The big-picture message is the same, but at the level of detail you get a difference. I do not think that that is necessarily unexpected.
Q4 Chair: What are the key factors to which you attribute the improvement in the findings to this year?
Gareth Davies: I will start, but Gaenor, as chair of our audit quality board, might want to add to it, because they get a view of what is changing over time.
I mentioned the investment that we have made, which is one key thing. We have had to do that because audit standards have changed. We have had to overhaul our methodology to respond both to that and to the findings of previous FRC inspections.
As the Commission knows, we have developed our own audit software platform, which has been used for two audit cycles now and is working really well. That is very relevant to quality, because it provides guide rails essentially for every audit team, makes it easier to do the right thing first time and to avoid mistakes, and improves the efficiency of the process alongside that.
The cultural and developmental areas that I talked about earlier are just as important—a culture of professional scepticism, which is a core audit principle, backed up by strengthening our technical expertise. We have centres of expertise now for valuations, for pensions and for financial instruments. Those have grown in scale as the work has become more complex, and our teams get stronger support now in those technical areas. There are other things, but I would pick out those main areas. Kate might want to add to that.
Kate Mathers: I think you have covered the main areas, Gareth. It is about people, processes and technology, and a very fundamental overhaul of our audit methodology. We have really modernised the detailed procedures that our teams need to carry out, and we have made sure that it is quite a granular translation of auditing standards into practical steps that our team can perform. That has been important. As Gareth said, the Apex system, with the guided workflows automation, has made an appreciable difference for our teams.
I would add that there is a very strong focus on people, particularly on the culture side of things. There is a recognition that this is really important for the primacy of audit quality. We have invested significantly in a lot of learning and development over the last couple of years, so we have really had a step change in that area. Our people will have felt quite intense training, not only on technical areas but on how they perform and operate as a team.
Gaenor Bagley: I would endorse all of that. Those are exactly the areas that we have been looking at in the audit quality board. For me, it seems that there has also been an absolute transformation in approach, which is now a very proactive approach to quality. It is about asking what we need to have in place right from the beginning, such as guardrails, automation and training, to ensure quality on every audit, as opposed to reacting to a bad audit opinion from the FRC. It is a complete transformation in approach, and it is paying dividends.
Q5 Chair: Would you say that the FRC is setting the bar at the right level?
Gareth Davies: These are tough reviews to go through. In my previous jobs, I have been through FRC reviews, and they are very searching. It takes a lot of time to do it properly, and you can be very confident that nothing is missed in one of those reviews. I give a lot of credit to the FRC for the improvement that we have made. Having to be publicly accountable for improvement against its findings has been a big driver for us—there are no two ways about it.
Of course, we as an organisation are believers in audit as a driver of improvement, so we have to take our own medicine. I think we have done it well: rather than be defensive about it, we are saying, “Actually, these are the professional standards. We want to be at least as good as the biggest firms in the country. This is specialist work for us, and we ought to be very good at it.” We have taken that as the spirit of the challenge. These are searching reviews, and our teams are very relieved when they are over each time, but I think they are appropriate in setting the right benchmark.
Q6 Chair: You mention being as good as the big firms. How would you describe the performance and quality of the NAO in comparison with the private sector?
Gareth Davies: One year does not make a trend, so we have to be careful. However, based on that year’s results, we are matching the performance of the big firms, and their performance is very good at the moment. They have invested much more than we have, in sheer cash terms, over the last few years, and the big four, as well as one or two others, are getting good reviews at the moment from the FRC. We have matched that this year, but the challenge for us is to stay there and do it every year so that we demonstrate consistency over time. That is when we will really feel that this has become embedded in the way the organisation works, and that it is then reliable for everybody who needs our work to be reliable.
Q7 Chair: What will you be doing to sustain this level of improvement going forwards?
Gareth Davies: We will keep going. As the Commission knows, we have a new five-year strategy, and we are in the first year of that. Even though we did a lot of work on quality in the previous strategy period, we have retained quality as one of our big priorities: we have two operational priorities, and quality is one of them, alongside influence. We could not be clearer with ourselves, our staff and the outside world that it is a huge priority. That means that we will continue to invest in keeping our tools up to date and making sure that our training is covering the necessary areas.
The point about audit quality is that you have never actually got there; you have to keep going, because the risks themselves change over time, and some of the technical issues change. We know that the Government are dealing with a huge range of complex issues, which is causing new risks to emerge in their accounts in different Departments. This is a constant job for us. It will never be complete, so we just have to make sure that we are investing the right amount every year.
Kate Mathers: I would add to that, in terms of practical ways that are driven by standards, that the key to our sustaining all this and embedding our improvement is our system of quality management.
There is a formal quality management standard from the FRC, ISQM 1, which requires each firm to have a robust system of quality management for the performance of its audit and management of its practice. We have been working very hard over the last couple of years to make sure that we have all the elements of that in place; it was a new standard introduced at the back end of 2022. The standard lays out the areas that a system needs to have. It covers things like leadership and governance; your resourcing, whether that is your people, your technology or your intellectual resources; and ethical issues. It sets out a whole range of objectives that you need to have, and what you need to achieve in those areas to be confident and have reasonable assurance that you will achieve a quality output.
That is where the FRC has pushed us to make sure that our system of quality management is in good shape, sufficiently well developed and operating effectively. That is a process of going through and looking at the risks to our achieving a high-quality output. It is quite an in-depth process, assessing the risks, the likelihood and the impact, targeting specific responses—this is a very proactive approach, as Gareth has said—and then having that continuous improvement feedback loop. If we find that things are not working, we address them: we put them into our quality-first plan and make sure we are tackling them. It is a journey, but we are working in a very focused way to make sure that our system of quality management is embedded.
Q8 Sir Geoffrey Clifton-Brown: Good morning, C&AG and fellow panellists. Do you anticipate that this year’s audit of your 414 accounts will be more difficult than last year’s? We are seeing trends of late accounts, incomplete accounts and more complex accounts.
Gareth Davies: There is a lot going on at the same time. We are seeing improvements in some areas.
We are seeing improved timeliness. There is still a slow recovery from the pandemic disruption. Frankly, it has arguably taken too long to get back to where it should be, but we are almost there with the main Departments. There is still more work to do with some of the arm’s length bodies, but we have some ambitious stretching targets on which we are working with Departments for the coming summer peak to improve that further, and at that point I think we will be back to where we should be with the main Departments. We have an ambition for every arm’s length body audit to be complete significantly earlier than some of them have been, so to reduce the tail of slow audits. There is progress on timeliness, but more to do.
We saw quite a surge in the complexity in accounts emerging from the pandemic, because of new loans and other financial instruments that the Government had entered into. The tail of that continues, but obviously we are now well practised in auditing some of those areas, so I do not see that as being increased complexity. Every year there is a new challenge, such as the creation of the Infected Blood Compensation Authority with a very complex provision that required significant attention from us. There is always something like that in each year. As the Commission knows, we are taking on the audits of the train operating companies, which is obviously a big new sector for us to get our heads around. We talked about how we are preparing to do that at your previous meeting, and that is going well.
I would not say that there is a deteriorating trend in quality of accounts. There is just a continuous cycle of change, and we have to make sure that we are anticipating that and well prepared for it each year.
Q9 Chair: What actions are you taking to ensure that you and your directors at the top of the organisation are setting the right tone when it comes to audit quality?
Gareth Davies: I mentioned our strategy. I think that is the clearest signal we can give the organisation that this really matters: having it right at the top of our strategic priorities. That will not have been news to anybody in the organisation; they have become very used to messages on audit quality from the top. I do a weekly Monday morning email to the organisation talking about things that are going on and the development of our strategy, and it gets regular mentions in there. Kate, as the senior executive leading on our financial audit work, has a regular blog and weekly messages to the financial audit service line, including quality messages. I think it is really clear that the whole organisation is lined up behind this. This is not seen as a technical issue for one part of the organisation; it is an organisation-wide issue, and our board is heavily engaged in it. Gaenor, as chair of the audit quality board, is leading that effort. Gaenor, you might want to say something about tone from the top.
Gaenor Bagley: Tone from the top is something that we think about a lot at board level. One of the things that the audit quality board looked at was how the quality-first plan has been communicated. We were very involved right from the beginning to make sure that the tone is right and felt inclusive, just as Gareth described. It has been a journey, and now it is in a really good place. It is front of mind, and the quality culture scores confirm that. Everyone feels very empowered and supported in the quality journey.
Q10 Chair: How do you go about ensuring that there are sufficient resources and that priority is being allocated to maintaining quality?
Gareth Davies: As you would expect, this is something that we test ourselves against as we set our budget each year and prepare the estimate to bring to you. We will shortly be going into that process for next year’s budget. You will see that a section of our estimate document focuses on how we are ensuring that we have the resources needed to do the work to a high standard.
There is clearly a tension here, as there is our drive to improve timeliness of audited accounts, which is very important, but that must never come at the expense of a high-quality audit opinion. We will never rush or cut corners or ignore something that we know we should be attending to just because it is preventing us from hitting a previously set deadline. The teams know that as well. They feel the pressure to improve timeliness, but they know that that never comes at the expense of audit quality. That means that we have to make sure that we are realistic about the resources needed to do the work on the set timetable. It requires really good discipline for us in setting our budget.
Before I bring Kate in, I should say that the other thing that is clearly a moving part of this calculation is the impact of our new tools on efficiency and resource requirements. We are starting to see significant benefits now from not just Apex but some of the individual tools we are using to automate the audit process. That is bringing down the number of days needed for a particular audit, and we think there is more to come on that. While we absolutely need to make sure that we have the skills and volume of resource needed for the job, we are very keen to demonstrate that our efficiency is improving over time as well.
Kate Mathers: That is right. Our teams are going through a very structured operational planning process at the moment. It is a combination of top-down guidelines and bottom-up detailed planning to make sure that we have a clear understanding of the resources we would need to deliver high-quality audits to the expected timetable. That is in train as we speak. That gives us a very clear view of what our teams are telling us that they will need in order to do a good job to the agreed timetables. We have a careful assessment of that.
Part of what we have asked this year is for teams to identify areas for efficiency. We have been up a very steep learning curve over the last few years with the introduction of new methodology and new systems to work on. We expect to see some benefits from that as well.
Gareth mentioned the introduction of some additional tools. These are our first steps into using automation, including a little bit of AI and machine learning to help us automate some of the very basic parts of the audit work—to help automate documentation of sampling work, and so on. We can already see some real efficiencies coming through in hours saved. That is the small end of things; we are in the foothills, but there are some real increases coming through to our efficiency, which teams can see and feel themselves.
Q11 Chair: What are your thoughts on the findings of the FRC that there were several instances that indicated that professional scepticism had been consistently applied throughout the audit? Do you agree with those findings? What action are you taking to ensure the consistent application of professional scepticism and challenge of management on NAO audits?
Gareth Davies: I do agree. This is one of those bits where I tell you that it is a continuous journey, and I think this will always be true. It is improving; some of the good results we have had this year are directly down to teams doing exactly that—challenging the information they have been provided by management, digging beneath the surface of it, looking for corroboration, and connecting different bits of evidence to say, “Hang on, these do not quite add up. What is going on behind that?”
Those are some of the thought processes that are behind this. There is good evidence that that is improving, but I think the FRC is right: we have to keep going on this. It is a good example of where this tension between time pressure and audit quality can play out—never allowing time pressure to stop you saying, “My judgment and my professional experience is telling me there’s something else I need to do here,” and making sure that is done. Those are good examples.
Kate Mathers: This has been a big focus of our quality first plan and the culture element within that. Obviously, to exercise good professional judgment, our teams do need to be sceptical. They need to know when to ask the extra question and to challenge management’s assumptions. We have to corroborate things, through detailed forecasts and so on, but also look for contradictory evidence.
We are now getting some good examples of where teams have done that really well. One of our approaches, as well as learning, development and training in these areas, is showing examples of good practice—what did the team do that led to the FRC saying, “This is a really good example of demonstrating that you have evidenced professional scepticism in the way you have reached your judgment?”
We have put some guidelines in for teams as well. We now set out, “This is the kind of thing you should do to show that you have challenged something. Are there alternative sources of evidence? Did you see the detailed forecasts that sat underneath management’s assumptions?” It is about being a bit more granular in the procedures that we ask our teams to carry out and very explicitly asking them to carry out steps that show the thought process in that. Sometimes it is a question of showing our workings in enough detail about how we have challenged as well.
Q12 Chair: Did that come out in your sampling?
Kate Mathers: Yes. We have had some good examples of that that we are able to show to our team. I am thinking one in particular, which was looking at a very complex provision with some efficiency savings built into it—we are talking about multiple billions of pounds. It was a question of really digging into it—how did the team challenge that? What evidence did they see? That was an example where we asked management ultimately to go back and rethink about some of the values within their provision, and a change was made as a result of that.
Q13 Chris Vince: The FRC also found some instances of insufficient testing to assess whether revenue had been recorded in the correct period. What action are you taking to address that finding?
Gareth Davies: That is a good example of a finding from an individual inspection that we would always check with our own inspection, to see whether this is a systemic issue or just the execution of that particular audit. It is important to know the difference, because if it is systemic, there is something to do with our methodology or our training that needs attention. If it is execution, we home in on the team and we use root cause analysis to say, “Why did that happen in this case, when we are not seeing it more widely? Is there something focused on that team that we can do to help them make sure they cover that next time?” Kate, you might know more about that.
Kate Mathers: In this particular case, we have made changes to our methodology around the types of management information they might look at. There is a cut-off procedure, so one of the risks to an audit is about whether management has recognised revenue in the correct period. There is a risk around cut-off, so we have given additional guidance and set out test procedures to tune up the requirements in those areas. Some of it relates to having assurance on the information provided by the entity—a system report and so on—and making sure that our teams have understood that that has been correctly prepared and properly drawn from a reliable system.
Q14 Chris Vince: On what Gareth said about determining whether an issue is systemic or relates to a particular team, does the fairly small sample of audits make that more difficult? If you were not sure, would you then do a deeper dive into the organisation?
Gareth Davies: The combined sample is quite big. We talked about our own sample of 25 or so, combined with the seven, so we are into the 30s collectively. That does give us good coverage, but you are right. If we genuinely are not sure and we think that is still an open question when we have looked at the other results, we would definitely consider looking at a wider sample of files ourselves, just on that one issue, because we could do that quite efficiently. One of the big advantages of Apex is that it gives us central access to every audit file whenever we need it. It is a very easy database to interrogate now, so that kind of check is easier to do than it was before.
Q15 Chris Vince: That is great. The FRC states that work remains to be done to develop and enhance the NAO’s quality management processes to ensure that they are sufficiently robust, which is obviously very important? Do you agree with the FRC on that particular statement?
Gareth Davies: Yes. I think Kate has already touched on this, but she might want to say more on what we are doing.
Kate Mathers: Yes, we agree with the FRC’s finding. I mentioned that, over the last couple of years, we have been implementing our response to a new standard on quality management. It requires you to put in place, as a quality objective, the assessment of risks in a detailed way, and what might prevent you from doing that. We had to tune up and improve the granularity and scope of our risk assessment, so that it really dug into what plausible scenarios could cause something to go wrong in one of our audits.
You will have different components of your system, one of which might be resources, and we mentioned this earlier. Have we got enough people, an do they have the right skills? That takes you into our processes and controls in hiring and development, as well as learning and development and training. It is about getting quite granular about this, and being quite precise about the response that you need to put in place to tackle and manage that risk effectively.
Of course, that needs to be documented, and you then need to make sure that you are monitoring your system. Is it doing what you expect? Are there any issues? That is when you get into the continuous improvement cycle as well. The FRC has asked us to do more in our risk assessment and the precision of some our responses. We have made good progress in that. We had its findings earlier this year, and we have done a lot of work to tackle that. We now need that properly embedded in our system, but we come to the end of the year in a good position.
Q16 Chris Vince: I emphasise that the FRC report is really good, and we are nitpicking—it is obviously an important process. I am really interested in the risk aspect, as I used to be a teacher, and I used to teach this. You said that you have taken on a lot of work with the rail operators being re-nationalised. There must be a whole multitude of risks related to that industry that you have perhaps not come across before, which must present some challenges. How are you approaching those challenges?
Gareth Davies: Exactly. We have set up a project specifically to manage the take-on of those new audits, reflecting the fact that they will come with some new risks, as well as some familiar generic ones. Clearly, there is the allocation of fair revenue to the different operators. When you buy a ticket, you are buying a general ticket that can often be used on multiple operators. That is a point that everybody who has used the trains will know, but it actually creates a significant audit risk. How do you make sure that revenue has been allocated accurately to each train-operating company? To give another example, you have the leasing of the rolling stock, and there are all sorts of other specific factors.
Our team is, first, meeting with the organisations themselves to understand their businesses properly. We are also meeting the outgoing auditors in every case essentially to get as much knowledge from them as we can on the areas that they have been tackling. Clearly, their reports are available to us, so we can see the risks that they have used as a basis for their audit structure. That is all coming together into the first set of audit plans that we will be producing in the next few months. That is a very intense process for us, reflecting the fact that it is a big sector and a new area.
Q17 Chris Vince: You are smiling, which suggests that you are also quite enjoying that new challenge—don’t worry; that was a statement, not a question. This is the last question from me. The NAO contracts out approximately 20% of your audit portfolio. What actions are you taking to enhance your quality monitoring of those contracted-out audits? I understand some of the reasons why you do that. Do you think that 20% is about right, and do you foresee that going up or down in the future?
Gareth Davies: This is obviously a big area for us. We are currently part-way through a process of bringing some of those audits back in-house, and that is a value-for-money decision on our part. We have set this out for the Commission at previous meetings. Essentially, the cost of outsourcing the more straightforward audits is now prohibitive for us, and we are significantly more efficient delivering those in-house. We have saved a noticeable amount of cash this year already, and we have plans for phases of that.
We will still be outsourcing a significant number; we think that it might be something like 15%, rather than 20%. The ones we are bringing in-house are the ones we know that we can do well and efficiently. That leaves the more specialist areas where there may be only one of those types of organisations that we are required to audit, and it would not be economic for us to acquire the specialist skills necessary. Those are the reasons for the remainder still being outsourced.
We also have a pretty clear quality framework for managing those. It is not as if we hand over all responsibility for those audits; I am still the person whose name appears on the audit opinion. My team works closely with the outsourced provider firm to make sure that we understand its planning process and that it covers what we expect it to cover, and my team is involved in attending the audit committee with the outsourced firm, and so on. We have a significant quality framework to make sure that the results are consistent with the ones we are delivering ourselves.
Q18 Sir Geoffrey Clifton-Brown: Kate Mathers, the transparency report 2024-25 shows that 100% of externally reviewed financial audits met your quality standards but that only 71% of your internal reviews met the financial audit quality standards. What is the reason for that? Are you being much harder on yourselves than in external reviews?
Kate Mathers: There is a reason why the results may be different. The trajectory is the same; we are seeing an improvement in our internal assessments as well as the FRC’s assessment. It is more modest, but we can see that trajectory, so that is consistent. The reason for the difference is really because, as I have mentioned, the FRC is a smaller sample, and it is very targeted at our highest risk audits. When we carry out our internal reviews, we are sampling from a broader population and trying to get good coverage of our directors and managers. It covers our largest, highest risk audits to some of the smallest ones, and it covers very experienced colleagues to newly promoted people, so we get a better breadth of coverage. The results reflect that context. We are looking at the same population but from a slightly different perspective to try to get a broader coverage.
To the question about whether we are more critical, I do not think that we are. We have been very assiduous over the years to try to align our review approach so that it is as detailed and carried out in the same way as the AQR, because it is important to us that we are benchmarking and getting indicators from our own processes as to whether we are moving in the right direction. We carry out cold reviews, which is after the audit has been completed—in the same way that the FRC would look at the audit.
We also carry out what we call hot reviews, which are quality reviews of audits that are in flight—so before they will be certified by the C&AG as well. We have recently started grading those in the same way that we would a completed audit review, and we are seeing an improvement there. In the current cycle of audits—the ones that have been signed off this year—our hot reviews are showing us that well over 80% are meeting standards. It is a slightly different type of review; it is a pre-certification review looking at the key risks within the audit. We have a different perspective for the inspections but consistency in the broad messages.
Q19 Sir Geoffrey Clifton-Brown: The same thing applies with your value for money reports; 83% of internally reviewed value for money reports met your quality standards, whereas 95% of externally reviewed ones met those standards. Again, it implies that your internal reviews are tougher than the external reviews. By the way, if you had asked me, as the biggest user of value for money reports, the rating might have gone up—but there we are.
Gareth Davies: First, I hasten to say that that does not imply that there is anything wrong with the reports themselves. This is about whether the audit file provides a consistent trail of evidence to support every finding in the report, which is of course our objective. It is a high compliance rate, but it is not perfect. We use those to find out why it is hard to follow the audit trail for a particular finding when it should not be. That is the kind of thing we are picking up in those reviews. In no case have we found that there is anything wrong with the conclusions in the audit report.
On the question of internal versus external, in some ways our internal reviews start with a head-start, because they are being done by people for whom this is the day job, and that is not the case for our external reviewers. They know where to look and they know the questions to ask, so I am not completely surprised that it is that way around. Both of them are, I think, a pretty good performance. Provided we always act on the findings of each review, I think that we have a robust system, both internal and external.
Q20 Sir Geoffrey Clifton-Brown: C&AG, changing the subject to new IT—you know that the Public Accounts Committee has been very pushy on all Departments, all the public sector, using more IT—you have already extolled the virtues of IT and its efficiencies. How far along that road are you? Are there more efficiencies that you can drive out by using IT?
Gareth Davies: Definitely. We know that there is, because we can see where this is heading in some areas. The profession has been talking about the application of new technology to audit techniques for decades, and there has been progress, but that is accelerating now. Rather than just describing the audit of the future, we are starting to see it appear in real cases—Kate mentioned a couple.
On software, for example, rather than the trainee auditor having to dig out an invoice, match it to the figure in the ledger and carry out an audit test, that can be automated. That whole process can be automated now, using optical character recognition and software that compares the two files. Of course, people still need to apply audit judgment and someone needs to check that the machine is not churning out misleading results, but we are finding that in that case, it is three times faster to do the job than it used to be, with obvious consequences for our overall resource requirement. That is just one tool.
We are doing some pilots of commercially available AI tools like Microsoft Copilot, which many people use in their own lives, but that turns out to be extremely useful for helping us speed up the review of board minutes. A standard bit of every audit is to check whether there are any issues emerging from the board minutes that we need to follow up on as part of the audit. In a big organisation, that is quite a big job for a junior member of staff to piece together, but Copilot is helping us accelerate that process significantly. Again, someone needs to check that what is coming out of that is intelligent and that it has not missed anything significant, but we are very confident that that will be a useful addition to our armoury.
When Kate used the phrase “foothills” about this, you can see what we mean. Some of this will require specialist audit software, but quite a lot of it is us adapting productivity tools to the audit world. Lots of other firms are doing the same thing, so I think it will be important. Hopefully, the Commission will see over time—we will be able to demonstrate this to you—the cashable efficiency flowing from it and the quality improvement. This is not just about less time to do the job; it is also about more insight for the audit committee and the management of each organisation, because of what the results of this kind of work can give. Why, for example, does one organisation I am thinking of need 1.5 million manual journals every year to move figures around in its accounts? That feels excessive compared with other organisations we know. That is new information in quite that way, and I think we could really help with the Government efficiency drive by using that data more intelligently.
Q21 Sir Geoffrey Clifton-Brown: From the public sector, we know about the difficulty of recruiting and retaining the appropriate digital specialists. Are you able to recruit and retain sufficient people to do it? It is all very well having all those sophisticated tools, if the right specialists are not there to use them—you would not be getting the maximum benefit. Equally, you need continuous professional development in this field, because it is changing so fast. Are you managing to do that sufficiently?
Gareth Davies: Yes. You can see from the evidence of our progress that we have been able to attract people who have been very useful to us and have had the right skills to get us to this point on new technology. I pay tribute to our team. Some people have been there a long time, others have recently joined us, but the combination has moved us on very fast and very effectively. I think we have done a great job, but that is the hardest bit of our skill mix to retain and recruit. We see very good people tempted away by big salaries in the private sector for the same skills. We obviously try to do what we can about that, but essentially it is our general retention challenge writ large. Because this is such a hot market at the moment, and probably will be for a long time, we are slightly resigned to having to replace fairly frequently, just because that is how the market for those skills works, but obviously we are doing what we can to ensure this is good environment for people with digital skills to work in. As a topical example, on Friday Kate’s team won the public finance digital project of the year award.
Sir Geoffrey Clifton-Brown: Congratulations.
Gareth Davies: That was for Apex, the system that we have been talking about. There are not many national organisations that you can be a part of that are at the leading edge of that kind of work in quite the same way as the NAO, so those are the kind of factors we use to retain and attract people. Pay is an important part of the mix. We cannot compete absolutely with the private sector, but we can compete in other areas, and the one I mentioned is one of them.
Q22 Sir Geoffrey Clifton-Brown: Finally, Gaenor, what impact has the audit quality board had on quality within the NAO?
Gaenor Bagley: I would hope that we have provided advice and guidance. As independent and external members, we have been able to provide some advice on how you would implement changes of this type and what sorts of things we are seeing on other audit committees and other boards. What springs to mind is that when we have been talking about the internal quality reviews, we have been determined to say, “These need to be held earlier, so we get the results earlier,” so that we can feed them into the whole system of quality management and provide more assurance to the board.
Chair: That concludes our questions this morning. Thank you very much for coming along.