Almost half of the UK’s leading broadband providers lack an internal audit function – leaving them exposed to unchecked risks and increasing the likelihood of corporate collapse. 

An open letter to telecoms regulator Ofcom from the Chartered Institute of Internal Auditors (Chartered IIA) has warned that widespread lack of internal audit across broadband providers in the UK is undermining the financial resilience of the sector.

The Chartered IIA has described the situation as a major audit and governance gap in a critical national infrastructure sector, bearing in mind the sector’s strategic importance to the UK’s digital economy. It is calling on Ofcom to follow the lead of financial regulators like the Financial Conduct Authority (FCA) and Prudential Regulation Authority (PRA) by setting a clear regulatory expectation that all broadband firms must have appropriate internal audit capabilities in place.

Vulnerable to collapse

The Chartered IIA warns that without independent assurance on internal controls and risk management, these companies could be more vulnerable to collapse, as seen in the energy sector, where none of the 30 failed suppliers – including Bulb – had an internal audit function.

The letter to Ofcom Chief Executive Dame Melanie Dawes urges the regulator to introduce a clear expectation for broadband companies to have internal audit to ensure robust governance, risk management and internal controls, after it emerged that six of the UK’s 13 major broadband providers – Community Fibre, Hyperoptic, Utility Warehouse, YouFibre, Glide, and CityFibre – currently operate without internal audit.

These companies collectively serve around two million customers and, in some cases, build and maintain their own infrastructure networks. CityFibre, for example, is the UK’s third-largest ISP infrastructure provider, supporting major ISPs such as Vodafone, TalkTalk, and Zen Internet.

Serious audit and governance weakness

Anne Kiem OBE, Chief Executive of the Chartered IIA, says: “Broadband companies are now essential to daily life and the economy. Yet nearly half of the UK’s major broadband providers are operating without internal audit. This is a serious audit and governance weakness. We’ve seen time and again the damage caused when companies collapse due to failures that might have been prevented with proper internal controls. We cannot afford to make the same mistakes with broadband companies.”

The Chartered IIA notes in its letter that there is currently no regulatory requirement or guidance from Ofcom that reflects the critical role of internal audit in ensuring effective governance, internal control and risk management.

The letter draws comparisons with other regulators that have acted decisively. Ofgem now requires energy suppliers to report on their internal audit capability in its updated Financial Responsibility Principle Guidance, while the PRA and the FCA mandate internal audit in financial services. 

Strengthening oversight

The letter concludes: “Setting a clear regulatory expectation for broadband companies to have appropriate internal audit arrangements would strengthen independent oversight of how key risks are managed, improve organisational resilience, build investor confidence, and support the growth of the UK’s digital economy.”

Victoria Geroe, Corporate Governance and Stewardship Manager at ICAEW, says: “A strong internal audit function is core to good corporate governance and can mean the difference between successful and unsuccessful management of risk and internal controls. 

“We support updated, sector-inclusive standards and stronger oversight via audit committees and assurance mapping, especially in publicly crucial domains such as broadband providers. Implementing strong internal audit functions is key to ensuring resilience and safeguarding public trust in a fast-evolving digital landscape.”