Financial Reporting Council updates its Audit Enforcement Procedure with new “Routes to Resolution”

The FRC has also updated its Sanctions Policy to reflect the enhanced discounts available on successful completion of the AP and the EAP, and its Publication Policy to reflect the introduction of PCE and the AP. Various other minor consequential amendments were also made to four other guidance documents.

An overview of the initial stages and routes to resolution are summarised in the flow diagram below:

Initial stages

The updated AEP replaces the ‘Case Examiner’ with a more senior ‘Designated Officer' as the officer of the FRC charged with carrying out the initial stages of an enforcement procedure. The Designated Officer is expected to be the FRC’s Executive Director of Supervision or another Executive Director (other than the Executive Counsel) to whom that responsibility is delegated.

The Designated Officer will assess information about a Statutory Auditor / Audit Firm to determine if it raises a question as to whether a Relevant Requirement has been breached and, if so, whether to refer the matter to the Conduct Committee. “Relevant Requirement” is defined for these purposes in the Statutory Auditors & Third Country Auditors Regulations 2016, and includes for example, a breach of those regulations or Part 16 of the Companies Act 2006 relating to audit. On referral, the Conduct Committee will consider whether there are reasonable grounds to suspect a breach of a Relevant Requirement and, if so, will decide whether to direct the matter to be resolved through one of the four routes to resolution or to take no further action, having regard to the public interest.

Once a route to resolution is selected, the appropriate notice is sent to the Statutory Auditor / Audit Firm and to either the Designated Officer (where the Conduct Committee directs CE or PCE as the route to resolution) or the Executive Counsel (where the Conduct Committee directs an AP or an Investigation).

Routes to resolution 

Constructive Engagement and Published Constructive Engagement 

The updated AEP introduces PCE to sit alongside the existing CE mechanism. These are consensual, remediation-based mechanisms which, if successful, do not result in the imposition of sanctions.

The Designated Officer will obtain information from the Statutory Auditor / Audit Firm about the audit work and the suspected breach of a Relevant Requirement through ‘proportionate and targeted’ enquiries. The Designated Officer will then seek to agree appropriate remediation action with the Statutory Auditor / Audit Firm, with a view to rectifying any breaches and adverse consequences, and preventing recurrence. Examples of possible remediation action include staff training, modification of firm-wide audit procedures and written advice.

There are three differences between CE and PCE: 

• PCE record: The fact that the Conduct Committee has directed a matter to be resolved through PCE will be recorded on the FRC’s website via an entry in a dedicated PCE record. The entry will only identify the Statutory Audit Firm which is the subject of PCE and summarise the issue that is subject to PCE.  There is no such public record where a matter is to be resolved through CE.
   
• Public announcements: Separately, the FRC may announce, by way of a press notice, that a matter has been referred to PCE, and the outcomes of the PCE.
  
  In relation to a referral announcement, there is a presumption against announcement which may be rebutted where the Conduct Committee considers it is necessary in all the circumstances (by reference to the factors in paragraph 11 of the Publication Policy), and the factors in favour of announcement outweigh any potential prejudice to the subject of the PCE. The factors in paragraph 11 include: maintaining public confidence in Statutory Auditors and Audit Firms, protecting investors and users of financial statements and preventing potentially widespread malpractice. These factors closely mirror those which the Financial Conduct Authority (“FCA”) considers when determining whether to announce the opening of an investigation.² 
  
  Conversely, in relation to an outcome announcement, there is a presumption in favour of announcement which may be rebutted where the Conduct Committee considers that it would not be in the public interest to do so. The Publication Policy does not specify circumstances in which it would not be in the public interest to announce the outcome of PCE. By way of comparison, in the financial services context, the FCA will not make an outcome announcement where it would be unfair to the person concerned, prejudicial to the interests of consumers, or detrimental to the stability of the UK financial system.³  Although this applies in the enforcement context in relation to investigation outcomes, it may nonetheless serve as a useful reference point in informing the FRC’s approach.
  
  In both cases, the announcement will not identify the audited entity nor the individual Statutory Auditor or include any details that would reasonably lead to their identification.
  
  Given the differences between the two regimes, the matters suitable for PCE will be those where it is considered necessary to publish the outcome for purposes of deterrence, transparency and/or education. In contrast, the individual outcomes of CE are not published, but the FRC communicates themes and learnings to the sector.
   
• Costs: The FRC may recover the costs of PCE from the Statutory Auditors / Audit Firm. Recoverable costs are capped at the total gross audit fees (and any relevant non-audit fees) charged by the Statutory Auditors / Audit Firm (including VAT) for the financial year(s). The Designated Officer has discretion to waive the requirement to pay costs where appropriate.

If the Designated Officer is unable to resolve the matter to their satisfaction through CE or PCE, the matter will be returned to the Conduct Committee for reconsideration. The Conduct Committee may direct the matter to one of the remaining routes to resolution.

Accelerated Procedure 

The AP enables an enforcement outcome to be achieved in a shorter timeframe and without conducting an Investigation. Instead, the Executive Counsel relies on information already held by the FRC – likely comprising a FRC AQR report, a self-report of a breach, and/or findings of another regulator or public body (the “Relevant Information”) – as the basis for proposing breaches and sanctions to be agreed by the Respondent (i.e., the Statutory Auditor/ Audit Firm subject to the AP). Accordingly, the AP is unlikely to be appropriate where the matter requires extensive expert evidence, review of large volumes of material, or indicates the possibility of pervasive breaches.

Following the issue of a Notice of AP by the Conduct Committee, the Executive Counsel will write to the Respondent inviting them to indicate whether they are willing, in principle, to explore resolution of the matter under the AP. Any indication of willingness is voluntary and given on a without prejudice basis. If the Respondent indicates at the outset that they will not accept any breaches or sanctions based on the Relevant Information, the Executive Counsel will return the matter to the Conduct Committee for resolution through one of the other routes. 

Otherwise, the Executive Counsel must determine whether the Relevant Information provides a sufficient basis on which to assess whether the Respondent has breached any Relevant Requirements and, if so, whether the Respondent should be liable for Enforcement Action. To do so, the Executive Counsel may also use its usual information-gathering powers, albeit in a manner consistent with the aims of the AP (i.e., timely and proportionate resolution).

If the Executive Counsel determines that the Relevant Information (together with any additional information obtained using information-gathering powers) does not provide a sufficient basis for a decision, the matter will be returned to the Conduct Committee for resolution through one of the other routes. Otherwise, the Executive Counsel must enter into settlement discussions with the Respondent through the usual process in Part 8 of the AEP.

The Executive Counsel initiates settlement negotiations by proposing breaches and sanctions to the Respondent by letter. This is expected to occur within four months of the Notice of Accelerated Procedure being issued, subject to the particular circumstances of the matter.

During the AP, at any time prior to a Notice of Referral to the Tribunal being issued (which may occur if no settlement agreement is reached), the Executive Counsel may return the matter to the Conduct Committee for resolution through another route if they consider that another route would be more suitable.

Investigation: Early Admissions Process

The EAP is introduced as an alternative to an Investigation, particularly suitable in circumstances where the Respondent (i.e., the Statutory Auditor/ Audit Firm subject to the Investigation) is already aware of deficiencies in the audit that are amenable to a self-review. A Respondent has 28 days from receipt of a Notice of Investigation to notify the Executive Counsel of their interest in participating in the EAP. 

The expression of interest by the Respondent is made on a without prejudice basis and accordingly cannot be relied upon by the Executive Counsel in any subsequent Tribunal proceedings. However, the resulting EAP Factual Account (discussed further below) is provided on an open basis.

Use of the EAP is subject to the approval of the Executive Counsel and is not available where criminal conduct is suspected. When determining whether the EAP is appropriate, the Executive Counsel will consider all relevant factors, including: 

• the seriousness of the issues under investigation – particularly serious cases are likely to require an Investigation on public interest grounds;
• the information already available about the issues under investigation – where significant evidence is already available to the Executive Counsel, the EAP is unlikely to add significant value;
• the scale, complexity and duration of the Investigation if the EAP were not to be used – use of the EAP should save significant time and/or resources; 
• the capability and resources of the Respondent (or any third party carrying out the self-review on their behalf); and
• the Respondent’s regulatory record, to the extent that this may have a bearing on their ability to produce a reliable EAP Factual Account.

If the Executive Counsel approves the use of the EAP, the Respondent will carry out a self-review of the matter on terms agreed with the Executive Counsel, and admit any breaches of Relevant Requirements identified in the resulting account they prepare, the ‘EAP Factual Account’. Where the Statutory Auditor and Statutory Audit Firm are both Respondents, they may participate in the EAP jointly, subject to both parties being able to agree on the conclusions and admissions in the EAP Factual Account.

The terms to be agreed between the Executive Counsel and the Respondent(s) at the outset of the EAP include:

• Scope and content of the self-review.
• Who will carry out the self-review - the Executive Counsel will expect the self-review to be led by an individual of suitable seniority (usually a partner), capability and independence. Where the self-review is to be carried out or supported by a third party, the Executive Counsel may wish to see the third party’s engagement terms and instructions in advance of work commencing.
• Methodologies - for example, the Executive Counsel may wish to see lists of search terms and the review manual, and to conduct their own quality assurance.
• Legal Professional Privilege (“LPP”) - the Executive Counsel cannot compel the production of privileged material; however, they will expect to be given access to material generated in the self-review. Where LPP is asserted in respect of such material, the Executive Counsel will expect the Respondent to provide it under a limited waiver of privilege, permitting its use for the purposes of the FRC’s functions (including the investigation and any resulting enforcement proceedings).
• Attestation as to the robustness of the enquiries made and the completeness of the account - if the EAP Factual Account is provided by a Statutory Audit Firm (either on its own behalf or jointly with any other Respondent), the attestation is usually made by a senior partner. The person making the attestation must be a professional accountant.
• Timing - ordinarily, the deadline for providing the EAP Factual Account should be no longer than six months.

Notwithstanding the agreed terms, the Executive Counsel may terminate the EAP at any time before receipt of the EAP Factual Account where it considers the use of the EAP is no longer suitable, e.g., where there is an unacceptable delay in completing the self-review.

Upon receipt of the EAP Factual Account, the Executive Counsel may make enquiries to satisfy themselves of the accuracy and completeness of the information provided, including by requiring the Respondent to provide further information. The Executive Counsel may then decide to:

1. enter into settlement discussions pursuant to the usual process in Part 8 of the AEP;
2. continue to investigate the matter; or 
3. decide that the Respondent should no longer be liable for Enforcement Action.

EAP and AP: Sanctions, costs and enhanced discounts 

As part of both the EAP and AP, the Executive Counsel will determine the appropriate sanctions by applying the Sanctions Policy on the same basis as with an Investigation. The Executive Counsel may recover its costs from the Respondent in full, provided they were reasonably incurred. A Respondent who accepts the breaches and sanctions proposed under the AP at the earliest opportunity, or who participates in the EAP to the Executive Counsel’s satisfaction, is eligible for an enhanced discount of 25% for exceptional cooperation, as well as up to 35% for early disposal.

Conclusion

The audit sector has welcomed the updates to the AEP. The introduction of alternative routes to resolution – whether remediation-based mechanisms that do not result in sanctions (PCE) or streamlined processes that deliver faster enforcement outcomes (the EAP and AP) – is, unquestionably, a positive development. As noted above, the updated AEP may be best understood as a strategy of modernising the FRC’s regulatory toolkit: equipping it with a more proportionate and flexible enforcement architecture that allows it to respond effectively and efficiently to different cases.

However, auditors and audit firms will need to be mindful of the strategic considerations associated with the different routes to resolution. For example, with respect to the EAP, Respondents will be obliged to make admissions on an open basis and waive legal privilege over potentially adverse material generated during the self-review which may be subsequently relied upon by the FRC if the matter proceeds to an Investigation. The risks of follow-on litigation will need to be carefully thought through and managed, particularly if the extent and nature of potential breaches is not known at the outset.

More broadly, the updates to the AEP echo recent regulatory trends in the financial services sector. The FCA is increasingly moving away from a rigid dichotomy between supervision and enforcement, with a greater focus on deploying assertive supervision in lieu of, or as a precursor to, investigations. The updated AEP reflects a similar approach: FRC supervision can now draw on the deterrence objective through PCE, whereas previously no publication tool was available to it in CE; and FRC enforcement can harness the efficiencies and proportionality of a more consensual, collaborative approach through the AP and the EAP.

Furthermore, the EAP closely resembles the Early Account Scheme (“EAS”) of the Prudential Regulation Authority (“PRA”), which similarly shifts the investigatory burden to regulated firms. Both schemes are accompanied by an enhanced discount framework to incentivise early admissions and require senior manager attestation. In a recent speech, David Chaplin, the Head of Enforcement and Litigation at the PRA, described what he characterised as a genuine "sea change" in enforcement behaviour noting that, across a growing number of enforcement investigations, subjects of investigations are “engaging with [the PRA] earlier in the investigations and enforcement process and proactively identifying, acknowledging and remediating breaches.” Crucially, he  emphasised that the benefits of the EAS are mutual: regulated firms benefit from reduced costs and shorter periods of uncertainty and disruption associated with prolonged investigations, while the regulator achieves more focused and efficient investigations.⁴  It will be interesting to see how the EAP develops in practice, and whether it realises similar efficiencies and benefits for regulator and firm alike.

However, the parallel with the PRA's EAS may be imperfect in one important respect. In the financial services context, early admissions processes are complemented by the availability of redress scheme mechanisms, which provides a powerful incentive for firms to engage early because they can facilitate a more structured resolution of both the regulatory proceedings and the consumer-related consequences of a breach. No equivalent redress mechanism exists in the audit context. 

The recent regulatory developments in the financial services sector have been prompted in no small part by the Government’s growth agenda and the pressure it has placed on regulators to demonstrate proportionality and reduce the regulatory burden on firms. In the same vein, the vast majority of the audit and corporate governance reforms that would have transformed the FRC into the Audit, Reporting and Governance Authority with expanded powers particularly in relation to directors of companies were abandoned at the start of the year.⁵  It will be interesting to see if, and how, upcoming changes to the leadership of the Government impact this reform drive.

¹ We have adopted the defined terms used in the AEP where their meaning is unchanged following the updates.

² ENFG 4.1.4 of the FCA Handbook.

³ Financial Services and Markets Act 2000, s.391(6); ENFG 4.2.14G of the FCA Handbook.

⁴ See our blog post here.

⁵ See our blog post here and the letter from the Department of Business and Trade here.