FRC Annual Enforcement Review – 2022/2023

The FRC has today published its Annual Enforcement Review for the year to 31 March 2023 (the “Review”). Many of you will by now be familiar with the format of the Review, which provides an update on the activities of the Enforcement Division for the prior year, as well as looking to the year ahead. It provides a useful source for monitoring themes and trends in enforcement practices. In this note we have summarised what we see as being some of the key points of the Review, and our thoughts.

The key statistics

As always, the Review includes a wealth of information and statistics which give us an insight into the Enforcement Division’s activities, and allows us to compare performance with prior years. 

Cases concluded in the year

The FRC’s own press release accompanying the Review led with the headline that the FRC had resolved a record number of enforcement cases. In total, 19 cases were concluded in the year to 31 March 2023, up slightly from 17 in the prior year (which itself was a significant increase). Seven of these are described as legacy matters, meaning that they were opened on or before 31 March 2019.

Of these 19 concluded matters:

• 11 were concluded through settlement (down slightly from 13 last year);
• 1 through a tribunal hearing (the KPMG/Carillion AQR matter); and 
• 7 cases were closed with no further action, up from 3 in the prior year.

This increase in cases closed with no further action shows a marked change from the prior year. While it may be too early to detect any trend, and this figure may be skewed by historic matters, it is likely to be welcomed by firms and individuals as indicating that even once an investigation has commenced, the FRC remains open to the fact that ultimately there may not have been any breaches (or at least not any that merit enforcement action/sanction). Three of these cases were matters under the Audit Enforcement Procedure (“AEP”) and four were under the Accountancy Scheme (likely investigations into members in business).  

New investigations opened 

The number of new investigations opened in the year is down a third on the prior year, from 15 to 10. For the previous three years, the number of new investigations had remained fairly static at 15 (or 14) and against that backdrop the fall in the number of new investigations is arguably fairly significant. The Review recognises this decrease, but does not point to any particular contributing factor. This, combined with the increase in the number of matters concluded in the year, means that for the second year running the total number of open investigations at the end of the year has fallen. As at the beginning of this year (1 April 2023), there are 38 open investigations (down from 47 at the beginning of the year). 

Of these 38 open investigations:

• 32 are investigations into audit firms and individuals in relation to audit work (with one proceeding under the Accountancy Scheme, and the remainder under the AEP);
• 1 relates to non-audit work;
• 5 are investigations into professional accounts in business. 

33 of these investigations have been announced publicly, which seems to confirm the shift we have noticed over the last few years of moving towards publishing the fact of an investigation in most cases.  

Case Examination and Enquiry (CEE) activity

Where things have remained fairly static is in relation to the number of new Case Examination enquiries opened in the year. 70 cases were opened by CEE, very slightly up on 69 in the prior year (although, as we reported last year, that was in itself quite a significant drop from 95 cases in 202/2021). 57 enquiries were closed in the year, again relatively consistent with the prior year, with 40 remaining open at year end. 

As with last year, the most significant source of cases referred to CEE is other teams within the FRC (41 matters, just over 58% of all enquiries opened in the year). Within that, most come (unsurprisingly) from the AQR team, with a few referrals from the Corporate Reporting Review team as well as Audit Firm Supervision.   

The FRC’s focus on using the constructive engagement process as an effective and efficient alternative to opening an investigation has continued. Of the 57 cases concluded by CEE in the year, 16 (or 28%) were closed through the Constructive Engagement process. This is slightly down on 39% in the prior year, but does not seem to indicate an intentional move away from the use of Constructive Engagement. We note that a greater number of cases (more than 50% - 31 of 57) were closed with no further action in the year to 31 March 2023. This compares to approximately 37% closed with no further action in 2021/2022. We also note with interest that 5 (of 15) cases referred to the Conduct Committee in the year were in fact returned to CEE for constructive engagement, or closed with no further action.   

Sanctions

Total financial sanctions imposed in the year came in at £40.5 million (£28.5 million after discounts). This is down from the all-time high reported in the prior year (£46.5 million, £34.6 million after discounts) and no doubt reflects the fact that while the FRC concluded the highest number of cases this year, two fewer than last year were concluded with the imposition of a financial sanction. The FRC also imposed the highest financial sanction this year (£20 million prior to discount). This was the fine imposed on KPMG in respect of the Carillion AQR matter, although as is recognised in the Review, there were significant discounts to reflect KPMG’s self-reporting, cooperation and admissions, reducing the fine to £14.4 million. 

The number of non-financial sanctions imposed in the year (which includes reprimands, severe reprimands, declarations and exclusions) was also down from last year (49 down from 62). The non-financial sanctions imposed in the year included (a) an order prohibiting a firm from accepting appointment as a statutory auditor to any new PIEs for a given period; (b) an order prohibiting an engagement partner from signing any statutory audit report for a PIE for a period of two years; (c) appointment of independent reviewers to conduct reviews of an audit firm’s procedures in a specific area; and (d) orders requiring review and amendment of training programmes, root cause analyses and the monitoring of compliance with existing policies and procedures. As we noted last year, while it is difficult to argue against the rationale of using non-financial sanctions to improve audit quality, there is no doubt that they can have a significant financial impact on the firms in question. 

Timeliness of investigations

The FRC has indicated a change in the way that it measures performance against the KPI of two years from commencement of an investigation to the issue of an Investigation Report. Under the new method of measuring their performance, this means that they have met the two year KPI in 75% of cases. The figure reported for the prior year (using the new, comparative measure) is 57% (reported as 40% under the previous method of measurement). Notwithstanding the change in the way performance against the KPI is measured, there has clearly been an improvement in the timeliness of the investigation process.   

The Review also signals a new KPI that will be adopted for future years. From next year they will report against both: 

• Meeting the two year KPI from commencement of the investigation to service of an Investigation Report in 50% of cases; and
• Meeting a new, three year KPI from commencement of the investigation to service of an Investigation Report in 80% of cases. 

Looking at timeliness from a different perspective, the average length of time to service of an Investigation Report (or closure) has again increased slightly to 34 months (up from 33 months in the prior year, 26 months in 2020/2021 and 23 months in 2019/2020). This is attributed to three legacy investigations, two of which were closed without sanction after being paused for two and six years as a result of parallel proceedings brought by other regulators and another matter which was said to be an “exceptionally large and complex investigation”.  

In slightly more promising news, the average time for cases to conclude as a result of settlement is down from 39 months to 35 months. The average length for cases closed with no further action has increased significantly from 26 to 48 months, but that has been skewed by the legacy matters referred to above that were paused while other regulators took action. The average age of cases open at year end was 23.8 months, down slightly on last year. 

Key themes from concluded cases

The most common accounting areas which were relevant to the matters closed through Constructive Engagement are reported as being revenue and impairment, with the common audit failings being lack of professional scepticism, insufficient audit procedures and lack of professional judgement. 

As for concluded investigations, it will come as little surprise to anyone that the most common breaches remained failure to obtain sufficient appropriate audit evidence, insufficient audit documentation and lack of professional scepticism. In terms of audit areas, the Review places a spotlight on the audit of inventory, which came up in three of the investigations concluded in the year.   

Cooperation in investigations 

As you will be aware, the FRC is clear that investigation subjects are expected to cooperate with investigations, and potentially significant discounts on financial penalties are available for what the FRC terms “exceptional co-operation”. Conversely, anything deemed to be a failure to cooperate can amount to an aggravating factor when it comes to determination of sanctions. The Review this year includes a section giving some guidance on the minimum level of co-operation required, as well as examples of what may constitute exceptional cooperation.

Examples of expected, minimum co-operation include: investment in the resources necessary to ensure timely, complete and accurate compliance with FRC notices; the provision of digital evidence competently, efficiently and in accordance with specifications; early identification of material subject to Legal Professional Privilege; the importance of careful and accurate reviews of emails (and other digital material) prior to provision to the FRC; complete, accurate and clear responses to written questions; proper preparation for interviews and the provision of clear information as to any remedial action already taken by the firm. 

Examples of what may amount to exceptional cooperation include self-reporting of issues at an early stage, coupled with admissions of breaches; own initiative activity, for example in circumstances where the FRC has identified areas of concern and the firm carries out an internal investigation or root cause analysis which is then provided to the FRC; assistance in resolving privilege issues, including in particular firms voluntarily waiving privilege over their own internal investigations. 

Looking ahead

The Review notes that many of the issues identified in this section in the prior year (hybrid working, inflation, geopolitical turmoil) continue to create challenges for preparers, audit committees and auditors, particularly in the areas of going concern, assessment of risk, and judgement and estimates. It notes that understanding of an entity and its environment is therefore of critical importance. 

The Enforcement team will also pay particular attention to issues arising in areas of focus for other divisions of the FRC, including the previously announced areas of supervisory focus for Corporate Reporting Reviews and AQRs. This includes CRR thematic reviews of insurance contracts, climate related financial disclosures and fair value measurement. Audit quality inspections will focus on going concern, fraud risks, climate related risks and the application of the revised audit standard in risk identification and assessment. Other areas identified in the Review include quality management (ISQM(UK)1 and ISQM (UK) 2) and sustainability and ESG reporting assurance. 

Key takeaways

Some key takeaways from us: 

• In many respects, not much has changed from the prior year. There are perhaps some early signs that the time taken to conclude matters is improving, and it is to be hoped that this is a trend that will continue. It seems that Constructive Engagement continues to be seen as a useful process for resolving matters at an early stage, without the need to proceed to an investigation, and that is also to be encouraged.
• There has been quite a marked decrease in the number of new investigations opened in the year, but it is not easy to identify any one particular reason why this is the case. One obvious answer may be that we are seeing the impact of the increased regulatory scrutiny of audit firms over the past five to ten years and the fruition of the investment that has been made in improving audit quality.
• Amongst the new investigations opened, 75% are into Big Four firms. This compares with the prior year when the majority of new investigations (77%) were into non-Big Four firms relatively new to the PIE market and/or with a small number of PIE audits. This change may suggest that the FRC is conscious of concerns that its enforcement activity is dissuading smaller audit firms (and their insurers) from entering the PIE market. 
• Whilst the examples contained in the Review for assessing co-operation will not come as any surprise to those advising audit firms, it is useful to have examples of practices indicative of co-operation (and enhanced co-operation) articulated. It is clear that the FRC will continue to focus heavily on co-operation during investigations. As we noted last year, while it will not always be appropriate or possible to go to the FRC with early admissions, it is clear that it is something to be kept under close review, and can result in some significant financial discounts. On a more day to day level, the examples given in the Review demonstrate the importance of close attention to every aspect of an investigation process. For example, even entirely innocent errors made during an email review may create difficulties in the future.