Written evidence submitted by the Chartered Institute of Internal Auditors (DAR0013)

Darren Jones MP

Chair

Business, Energy, and Industrial Strategy Committee

House of Commons

London

SW1A 0AA

Submitted via online submission form

Dear Mr Jones,

Call for evidence: Delivering Audit Reform

The Chartered Institute of Internal Auditors (Chartered IIA) welcomes the opportunity to contribute our views to the call for evidence on delivering audit reform.

The Chartered IIA represents internal audit professionals in organisations spanning all sectors in the UK and Ireland, and it champions the contribution internal audit makes to good corporate governance, strong risk management and a rigorous control environment leading to the long-term success of organisations.

The Chartered IIA is happy to discuss any of the comments included in the response.

We are happy for our response to be published.

Your sincerely,

John Wood

Interim Chief Executive

Call for evidence: Delivering Audit Reform

Introduction

The Chartered IIA represents over 10,000 internal audit professionals in organisations spanning all sectors of the economy, across the UK and Ireland. We champion the contribution internal audit makes to good corporate governance, strong risk management and a rigorous control environment leading to the long-term success of organisations, including those in the public sector.

As representatives of the internal audit profession in the UK and Ireland, we have a keen interest in the proposed reform of the UK’s audit industry. As such, we have submitted detailed responses to the audit reviews led by Sir Donald Brydon and Sir John Kingman, as well as of course the Committee’s own Future of Audit Inquiry, and welcome the opportunity to contribute our views to this latest call for evidence on delivering audit reform.

Overall, our opinion is that the Government could have moved faster to deliver audit reform. We note that Carillion collapsed two and a half years ago, bringing to light corporate governance and auditing failures that led to thousands of workers losing their jobs and costing tax-payers £148m. Since then, we have seen a series of independent reviews and public consultations looking at audit reform.

In March 2019 we were pleased to see the Government make a clear pledge to ‘act swiftly’ on audit reform, but over a year later is yet to bring forwards a comprehensive audit reform package. Sadly during this period, we have seen further major corporate collapses, some of which have also been linked to audit and corporate governance deficiencies, including Patisserie Valerie and Thomas Cook. Underlining the need for the Government to deliver audit reform with urgency.

We recognise that the coronavirus pandemic means the Government has had to shift its priorities to address the urgent health and safety and the economic issues arising from the current crisis. However, we would argue that with businesses now being exposed to a level of adverse risk not seen since the global financial crisis, including significantly increased financial, capital and liquidity risks for many of those businesses, a robust corporate governance framework and effective audit is needed – now more than ever – in order to support boards to manage and mitigate the risks they face successfully.

We note that the reviews mainly focus on external audit reform, however, a number of the recommendations do have an impact on internal audit. Given the internal audit profession’s role in promoting good corporate governance within the companies they serve, and its position as part of the wider audit community, we also clearly have a significant stake in ensuring a well-functioning and high-quality external audit sector.

In our response below we have offered views consistent with those we advocated previously on audit reform.

Do the proposals from the three reviews of audit fit together as a coherent package that can deliver meaningful reform?

The interlinked reviews were asked to look at very specific pillars of the audit framework. The CMA focussed specifically on the audit market, Sir John Kingman focused specifically on reform of the audit regulator and then Sir Donald Brydon focused specifically on the quality of the audit product. There are overlaps and interdependencies relating to the recommendations made by the three reviews and we believe that there is coherence in some areas.

For example, both the Independent Review of the Financial Reporting Council and the Independent Review into the Quality and Effectiveness of Audit recommended strengthening the internal controls framework (and in particular the responsibilities on directors), learning the lessons from the Sarbanes-Oxley Act in the US. This is coherent with the CMA’s recommendation to introduce statutory regulatory powers to increase accountability of companies’ audit committees. Both the Brydon and Kingman reviews also highlighted the importance for the Financial Reporting Council (FRC) to be replaced by a new, more powerful, regulatory body.

Ultimately, all three reviews proposed recommendations that would strengthen the audit framework by ensuring a stronger audit regulator, improved audit quality and a healthier audit market based on promoting greater competition.

We have supported the overall thrust of the recommendations of the three reviews and have summarised below those we think would have the most impact, those we have cautioned against as well as those that need further thought and consideration.

The Independent Review of the Financial Reporting Council

1)      We advocate for the Government to legislate and put the FRC on a statutory footing with its renewed mission, objectives, powers and sanctions (including the ability to sanction directors for misconduct) contained in the legislation as recommended by Kingman. This will make sure the FRC/new regulator has the powers it needs to do its job properly.

The Independent Review into the Quality and Effectiveness of Audit

2)      We support Brydon’s recommendations for a strengthened framework around internal controls in the UK and increased responsibilities for company directors in relation to internal controls over financial reporting. We believe that this would help to raise corporate governance standards. 

We agree with Kingman and Brydon that there may be a case for introducing into the UK a Sarbanes-Oxley style system, however we have cautioned against any new regulations on internal controls that are overly prescriptive as this could cause unintended policy consequences.

3)      Another recommendation suggested in the Brydon review is the creation of an independent profession called the “corporate auditing” profession. This new profession would have a broader scope and encompass all auditors of corporate information such as cybersecurity and environmental measures, as well as statutory auditors of financial statements.

We believe that more thought and consideration should be given to the scope of this new profession as there could be a conflict between the work of internal audit and the proposed “corporate audit” work. The scope of the new profession, as it is suggested by Brydon, is going beyond the traditional role of external audit work of providing assurance over financial statements and into providing assurance on areas that internal audit is engaged in such as culture, cybersecurity and ESG. We would like to ensure that the current clear separation between the two functions is maintained to ensure not only that there is no significant duplication of work, but also to make sure both functions remain independent and objective through having their own clear roles and responsibilities.

We supported the view that ARGA should establish an overarching framework that governs the work and behaviour of external auditors and that standards and rules for the profession sit within this framework. However, careful thought and consideration should be given to these principles to ensure that there is clarity and accountability between the two audit professions.

The CMA’s audit market study

4)      We have welcomed one of the CMA’s main proposals for there to be an operational separation between statutory external audit and non-audit work. We believe that this would increase the quality of the external audit provision, as well as mitigate the risk of conflicts of interest.

5)      One recommendation that was suggested by the CMA that we do not support is the proposal for “joint audits”. We believe that joint audits risk becoming overly burdensome for businesses and there are significant unanswered questions about how they would work in practice. In our opinion, shared audits would work better and have been more broadly supported by the industry and wider stakeholders including the business community.

Auditor rotation

One area that has been omitted by the reviews is the current rules surrounding the rotation of external auditors. We believe that the current regulatory framework, which allows professional services firms to carry out external audits for a PIE company for up to twenty years before a mandatory rotation is required, is hampering healthy competition within the audit market for PIEs. These arrangements have major implications for competition within the external audit market as this limits the number of external audit contracts that come up for tender in any given year – limiting the number of new business opportunities for any potential new entrants.

In addition to the effects on competition, a further significant implication of the current arrangements is that it means that over a period of service spanning up to twenty years, there is a potential risk that an external auditor may lose their objectivity, independence and scepticism as a consequence of their length of service working closely with the business they are servicing and become too close to senior management.
 

In this respect, we believe that it could be beneficial to strengthen the current guidance and regulations governing the rotation of partners and providers of external audit services. In our response to the BEIS Committee Future of Audit Inquiry, we suggested to strengthen the current FRC guidance on the 5 year rotation period for the audit engagement partner and key audit partners by making the current 5 year rule mandatory for the external auditor provider of all major companies, as well as allowing the 5 year period to be extended to 7 years under exceptional circumstances and only with the approval of the audit regulator. Then, at the 10 year point, companies would be mandated to change their external audit provider.

Following the recommendations of the three interlinked reviews, we believe that the onus is now on the Government to bring forward a coherent audit reform package that weaves the reviews recommendations together. The Government should do this as a matter of urgency. Further delay in bringing forward a coherent audit reform package risks undermining the UK’s enviable reputation for world-class corporate governance and a reliable place in which to do business.
 

Which reforms can be delivered without legislation and what progress has the FRC made in implementing such reforms ahead of future legislation?

In our opinion, the recommendation that should be at the front and centre of the Government’s audit reform package is to put the FRC on a statutory footing with renewed powers to give the audit regulator the teeth it needs to do its job efficiently and effectively. This would require legislation and we urge the Government to engage the legislative process with no further delay. Without legislation the FRC will continue to operate on a sub-optimal basis and will be limited in what action it can take when issues arise.

However, there are a number of recommendations that can be delivered without legislation and our understanding is that the FRC is doing all it can to implement those and that strong progress is being made.

Below are the main recommendations that don’t require legislation and that we have supported:

1)      Replacing the FRC’s name (recommendation 3, Kingman review)

We have supported Kingman’s recommendation that the new regulator should be named the Audit, Reporting and Governance Authority (ARGA). We believe that this change should be expediated as it would signal a significant change to the role of the FRC, support the changes already being made and encourage the required legislation as a matter of urgency.

2)      Changing the FRC’s strategic objective (recommendation 4, Kingman review)

The review recommended that the new regulator’s strategic objective should be “To protect the interests of users of financial information and the wider public interest by setting high standards of statutory audit, corporate reporting and corporate governance, and by holding to account the companies and professional advisers responsible for meeting those standards”.

3)      Refocusing the FRC’s duties (recommendations 5 & 6, Kingman review)

Broadly speaking we have supported the duties and functions set out in recommendations 5 and 6 of the Kingman review. In our response to the review we made clear that we felt the current scope of the FRC was too broad, was too high level and their mission and objectives needed to be clearer, and that the FRC would benefit from a sharper focus. We were therefore pleased to see that this had been addressed in the duties and functions recommended by the review, which are far clearer and more focused.

4)      The role of the board (recommendation 7 & 8, Kingman review)

Whilst we supported recommendation 7 of the review, which recommends a new board for the FRC/new regulator with significant new powers and responsibilities, we also suggested in our consultation response to the review that the culture and outlook of the FRC/new regulator should be revisited after any changes stemming from the review have been implemented. So once the new regulator has been established, a new board has been appointed and a new culture has had time to be embedded, we would recommend the Government continues to monitor and assess the new regulator’s effectiveness at regular intervals as appropriate. This will help to ensure that the major shift in tone and culture required to rebuild stakeholder trust and confidence is delivered as envisaged.

In relation to recommendation 8, we agree that there could be value in having a smaller board. Indeed, in our consultation response to the review, we noted that the current FRC board is larger than that of many commercial companies. However, we also stressed that with a smaller board it is important that each board member’s roles are clearly defined so that as part of the annual performance appraisal by the Board Chair an assessment can be made as to the value they have brought to board meetings.

5)      The posts of Chair and CEO of the FRC should be subject to confirmation hearings with the BEIS Select Committee (recommendation 12, Kingman review)

We supported recommendation 12 as we believe that this would be an appropriate mechanism for ensuring Parliamentary scrutiny of the new regulator’s Chair and CEO, and whilst we appreciate that the BEIS Select Committee already has the power to call whomever they wish to appear before them, there could be value in formalising such an arrangement.

6)      The regulator to develop a robust market intelligence function (recommendation 44, Kingman review)

We supported recommendation 44 and were therefore pleased to see that the FRC had introduced this in their Draft Plan and Budget 2020/21 published in February 2020.

In our consultation response to the review, we also suggested that the FRC could establish a monitoring team to use market, media, financial and other data to monitor those significant businesses under the FRC’s remit to launch investigations and inquiries as warranted. We therefore suggested that the Government should work with the FRC to ensure that any new market intelligence function’s defined roles and duties included this.

7)      The regulator to adopt a more proactive approach when serious problems arise (recommendation 46, Kingman review)

We welcomed recommendation 46 that the regulator needs to be able to act quickly where potentially serious problems are indicated and that the regulator should be able to require rapid explanations from companies. Whilst we acknowledge this will require primary legislation to ensure that the FRC/new regulator has the necessary powers to do this effectively, we believe delivering a more proactive approach to the regulatory strategy and tactics at the regulator will be equally as important in achieving this. Along with new powers this will require a change in culture.

We have argued previously that the FRC is not quick and effective enough to act on warning signs regarding corporate governance, and there is a perception that the FRC will only investigate once a major failure has occurred. So along with giving the regulator the powers to act quickly, it is vital that a more proactive culture is embedded throughout the organisation that encourages a greater willingness to act swiftly and fully deploy the new powers it is given when and where appropriate.

We believe there is evidence over recent months of the FRC taking a more pro-active and strident regulatory approach. A good example of this would be the announcement by the FRC of sanctions against Grant Thornton in relation to its audit of Conviviality Retail, as well as the announcement of sanctions against KPMG in relation to its audit of Foresight 4 VCT.

8)      Conflict of interest for staff, board committee members of the FRC (recommendation 57, Kingman review)

We supported recommendation 57 and we were pleased to see that the FRC planned on implementing this immediately. In our consultation response to the review, we noted that it is important to have some safeguards to ensure the separation between recent partners of professional services firms and the FRC, and suggested for example a minimum time between retiring one’s partnership and joining the FRC, disclosing conflicts of interest, and limiting the maximum proportion of those working at the FRC that are from the Big Four.

9)      The FRC’s funding (recommendations 65 & 66, Kingman review)

Although Sir John envisaged that the FRC/new regulator’s budget should be raised by a statutory levy (recommendation 64) – which would require legislation – he also suggested two other recommendations that do not require legislation and that we have supported.

Recommendations 65 and 66 suggest that BEIS should agree a new budget, working with the new regulator and consulting stakeholders. BEIS should set the budget each year, and having consulted, determine the proportions of the levy that will apply to different parties.

10) The regulator’s pay arrangements (recommendation 69, Kingman review)

This recommendation supports our view that the FRC/new regulator should not be subject to public sector pay caps, that instead the arrangements for remuneration should mirror those of other financial regulators including the FCA and PRA. We are concerned that if left in place, the current restrictions on pay could over time substantially reduce the ability of the FRC/new regulator to recruit key specialist talent.

11) Operational separation of the audit and non-audit practices of the professional services firms (recommendation 3, CMA’s audit market study)

This recommendation put forward by the CMA would require a tricky piece of legislation, which could take many years to pass and be implemented. The FRC has instead proposed a voluntary operational separation by a different route involving negotiations.

Following a negotiation process that started in February this year, the FRC issued on 6 July 2020 an edict with 22 principles for the operational split of the Big Four. The principles include making the firms’ audit operations financially independent businesses, with separate boards led by independent chairs, as well as a ringfencing of audit costs and profits, and the partners in these businesses should be remunerated in line with the profits of their audits. The FRC has asked the firms to outline their plans to implement the principles by the end of October 2020 and have completed the measures by June 2024.

We believe that a voluntary operational separation is a step in the right direction, but we do have some concerns about how these principles will be applied consistently across the Big Four, to create a level playing field. There is a risk that these principles could be applied less stringently or interpreted slightly differently from firm to firm. We believe achieving a reasonable level of consistency in the application of the principles at an operational level will be fundamental for them to be effective.

However, if the FRC delivers against the regulation element ‘principles for operational separation’ of the document i.e.

1. Firms will need to demonstrate to the FRC that they are delivering these outcomes, consistent with these principles.
2. Firms should provide regular management information for the audit practice to FRC, including financial statements, audit quality indicators and other information which indicates whether these outcomes are being delivered.
3. FRC will publish annually an assessment of whether firms are delivering these objectives and outcomes.  
4. FRC will seek backstop powers to require firms to deliver these outcomes as part of the forthcoming audit reform legislation.

Then there is some incentive for the firms to embrace the opportunity that a voluntary separation offers, rather than waiting to be formally regulated. The voluntary separation does appear to have more buy-in from the Big Four and means it avoids or delays the need to legislate. For these measures to be effective we believe it will be vital for the FRC to meet with the firms on a regular basis to monitor and assess the implementation of the principles.

On the proposed timescale, given this is a voluntary operational separation that does not require legislation, we would like to see the implementation of the proposed measures accelerated and delivered before October 2024, if feasibly possible.

We welcome the move towards operational separation because it will ensure clear boundaries within the Big Four firms between their statutory external audit services and outsourced internal audit services or indeed any other consultancy services they may provide e.g. tax advice. At present, under SATCAR 2016, a statutory external audit provider to a company is prohibited from also providing internal audit services to that same company.

However, the operational separation should help to further eliminate perceived conflicts of interest and enhance the independence and objectivity of both the external and internal audit teams. It should also prevent staff from the external audit part of the business being shared with the internal audit team and vice versa, which we believe occurs, and when it does blurs the lines and the boundaries between the two. 

12) The introduction of shared audits

Another reform that the FRC has said could be implemented voluntarily is the introduction of “shared audits”. The CMA has proposed “joint audits” in its audit reform study, which would require the FTSE 350 companies in the UK to hire two accounting firms with both being legally liable for the audit. However, the FRC board has rejected joint audits and has proposed a non-legislative alternative known as “managed shared audits” that would need ministerial approval (source).

Our understanding is that this approach has been supported by over 150 companies and that the FRC have a handful of companies who are interested in piloting this and is in conversation with them to see if it is something that can be taken forward (source).

Will the reforms proposed by the audit industry itself address the failings that were identified by the reviews and the BEIS Committee’s Future of Audit Report?

All the professional services firms have put in place new measures to improve the quality of their audit work in recent months, in response to the criticism that the profession has been facing following corporate failures. These measures include the promise to stop providing consulting services to audit clients, recruiting more experienced auditors, increased training programmes for their existing auditors, or pledging to restructure their audit division so that it had a separate performance management and governance structure.  

However, whilst we cautiously welcome these measures as a positive step in the right direction, we remain concerned that these measures alone will not deliver the step-change in the quality and effectiveness of audit that is urgently required in order to strengthen the corporate governance, risk management and internal control framework.

This is evidenced by the fact that according to the latest annual review by the FRC a third of company statutory audits by professional services firms failed a quality test with 29 out of 88 external audits needing improvements and 7 of these needing significant improvements. Whereas last year 26% failed the same quality test, demonstrating a further deterioration in external audit standards. This helps to demonstrate why fundamental change is now required urgently.

When will the Government bring forward its proposals and the necessary legislation where required?

Our understanding is that the Government will bring forward their audit reform package for consultation in the autumn of 2020 (we have been told October). We note that this was originally planned to take place in March of 2020. Despite assurances we remain concerned that there may be further delay as a result of the coronavirus pandemic.

Whilst audit reform was mentioned in this year’s Queen’s Speech, it is unlikely now that there will be any legislation passed this year. But we believe the Government needs to progress audit reform with a greater sense of urgency. Our understanding before the coronavirus crisis was that the Government’s plan was to bring forward legislation by 2022, however it is now realistic and reasonable to expect it could be delayed to 2023 – five years after Carillion collapsed, which was the main catalyst for reform.

The pace of audit reform in the UK is slow in comparison to similar action taken by other countries following major corporate collapses. For example, in the US the Sarbanes-Oxley Act was introduced six months following Enron’s collapse.

Will audit reform help track progress made by companies in meeting the UK’s Sustainable Development Goal commitments and in particular Net Zero?

The UK’s Sustainable Development Goal commitments include a target that will require the UK to bring all greenhouse gas emissions to net zero by 2050.

The future of audit is closely linked to the future of reporting and there are strong incentives, notably led by Mark Carney, former Governor of the Bank of England and now special United Nations Special Envoy for Climate Action and Finance, to increase climate-related information disclosure. This would result in greater transparency and trust in business, which is also in line with what the audit reforms aim to achieve.

How will audit reform fit with wider corporate governance reform?

The proposed reforms aim to promote greater transparency, openness, and trust. We believe that these goals are consistent with those of the UK’s Corporate Governance Code and the Government’s approach to pursue policies that enhance and make stronger corporate governance. We believe that a robust audit and corporate governance framework is vital if we are to restore trust and confidence in not only the provision of external audit and financial reporting, but in the business world more widely.

To enhance internal audit’s role as a cornerstone of good corporate governance, is why we published in January of this year, a new Internal Audit Code of Practice which provides guidance on effective internal audit in the private and third sectors. The Code is principles-based, and is intended as an industry benchmark, to help internal audit functions and audit committees embed good practice internal audit and raise the bar across the internal audit profession.

The Code has been welcomed by Sir Donald Brydon in his final report on the Independent Review into the Quality and Effectiveness of Audit; Sir Jon Thompson, CEO of the FRC; as well as by the chief executives of most accountancy bodies such as ICAEW, ACCA, CIMA, and ACCIF.

August 2020