By understanding the range of auditor communications, stakeholders will gain a better overview of the purpose and context of the independent auditor’s report and the statutory auditor's wider impact and role.
Auditors communicate with a wide range of stakeholders in different ways. They communicate formally and informally, directly and indirectly, including with shareholders, audit committees, management, employees and regulators, among many others. Audit reports, reports to audit committees and management letters are just a few examples of written communications that have developed over many years.
Although much of what auditors communicate is addressed to a limited audience, for a specific purpose, and is often constrained (sometimes heavily) by law and regulation, auditor communications are critical to maintaining confidence in corporate reporting. Without good quality communications from auditors, the financial reporting ecosystem starts to fall apart.
The quality of auditor communications matters, regardless of the audience, because it has a direct effect on the decisions taken by the audited entity. Excessive complexity, ambiguity and any other lack of clarity, particularly when combined with boilerplate text, can undermine trust and actively hinder decision-making.
Auditor communications can be difficult to understand. Despite significant changes in recent years, particularly to the audit report, concerns remain about the effectiveness of some auditor communications, with calls for them to be improved. But statutory auditors' reports are just one of a growing number of increasingly complex, wide-ranging and sometimes sensitive requirements for auditor communications.
Below we set out stages of the audit process and the stakeholders auditors are likely to communicate with, how they do it and why.
It is not an exhaustive list but provides an insight into the increasingly wide reach and interconnectivity of auditor communications.
Change in auditor
-
Those charged with governance
This includes executive directors, non-executive directors and members of the audit committee.
What: tender process
Why: for public interest entities (PIEs), specifically defined by the FRC, with audit committees, there is a legal requirement to carry out a selection procedure (Companies Act 2006 Section 485A and Article 16 (3) of the Audit Regulation). The audit committee conducts a tendering process and makes recommendations to the board. For PIEs, the audit must be put out to tender at least every 10 years (Companies Act 2006, section 494ZA).
What does this mean: when a company needs an auditor, it usually invites different audit firms to ‘bid’ for the audit. This can involve written proposals, interviews and presentations. For PIEs, the tendering process is a legal requirement. For others, it may simply be custom. For larger companies, it is often the audit committee that oversees this process, and they report back to the board.
How: written proposal document, verbal discussions with management, oral presentation.
-
Incoming auditors or predecessor auditors
What: details of any circumstances that need to be considered when deciding whether to accept appointment
Why: to evaluate whether there are any reasons why the auditor should not accept appointment. (ICAEW Code of Ethics R320.8)
What does this mean: before an auditor takes on a new entity to audit, they have a duty to check with the previous auditor if there are any ethical or other reasons, including disagreements, on why they should not accept the appointment.
How: written request
What: arrangements to review predecessor auditor working papers
Why: to obtain sufficient appropriate audit evidence over opening balances (ISA (UK) 300 13b, ISA (UK) 510 6c)
What does this mean: new auditors typically do not re-audit all opening balances, but in practice they often review the predecessor's working papers to get comfortable with the balances as the starting point for the current year.
How: not specified
Independence
-
Audit committee (if PIE)
What: auditor’s declaration of independence
Why: the auditor is required to confirm annually that the firm, along with its partners, senior managers and managers involved in the audit, maintain independence from the audited entity. (ISA (UK) 260 17-1)
What does this mean: each year, for PIEs, the auditor is required to confirm that no one on the audit team is involved with the audited entity in any way that could jeopardise their independence for the audit (for example, family/friend connections).
How: annual confirmation in writing. Discussion on any threats identified and safeguards applied that may need to be in writing.
Reappointment and engagement
-
Those charged with governance
This includes executive directors, non-executive directors and members of the audit committee.
What: auditor reappointment
Why: companies legislation requires that auditors are appointed for each financial year.
What does this mean: for public companies, an auditor must be formally reappointed each year, regardless of whether a retender process is taking place. This typically occurs at the annual general meeting by shareholder vote. For private companies, auditors may be deemed to be reappointed.
How: ordinary resolution at a meeting of the company’s members
What: terms of the audit engagement
Why: to agree the objective and scope of the audit, the respective responsibilities of the auditor and management, the financial reporting framework and the form and content of reports to be issued by the auditor. (ISA (UK) 210)
What does this mean: an audit engagement letter is essentially a formal agreement between the auditor and the company being audited. It ensures that both parties are on the same page about what the audit will involve and what is expected from each side.
How: written agreement
-
Audit committees
What: a copy of the audit engagement letter
Why: to facilitate review and agreement by the audit committee and ensure any change in circumstances has been reflected. (ISA (UK) 260 A9-1 and per the FRC Guidance on Audit Committees).
What does this mean: the audit committee is responsible for agreeing the terms of engagement of the external auditor.
How: written letter
Planning
-
Those charged with governance
This includes executive directors, non-executive directors and members of the audit committee.
What: planned scope and timing of the audit
Why: to help those charged with governance to better understand the implications of the auditor's work, engage in discussions regarding risk and materiality, and pinpoint areas where they may request the auditor to perform additional procedures.
What does this mean: audit planning typically requires various communications with those charged with governance and management. Some communications, like the audit plan, are more formal, while others, such as discussing business changes over the year, are more informal.
How: either verbally or in writing for entities that are not PIEs. See reporting and completion section below for examples of specific requirements that need to be made in writing for PIEs.
What: obtaining information relevant to the audit, including a detailed understanding of the business
Why: to help the auditor better understand the entity and its environment. (ISA (UK) 260)
What does this mean: auditors need to understand the business, its industry, and any changes during the year. These factors can affect the risk assessment, help the auditor design tests effectively, help the auditor set materiality and impact the overall audit approach.
How: not specified.
-
Goup, component or overseas auditors
What: group audit instructions and engagement letter
Why: to discharge the group engagement partners' responsibility for managing audit quality on the group audit engagement (ISA (UK) 600).
What does this mean: the group audit partner oversees the whole group audit and ensures it is carried out properly. Part of the group may include companies that are audited by different audit firms, either in the same country or overseas, or by the same audit firm in a different location and it’s important to collaborate effectively with these auditors. This means sharing clear instructions about what they need to do for their part of the group audit.
How: written instructions/letter and involvement in planning meetings.
Fieldwork
-
Internal audit
What: to discuss audit fieldwork queries and any controls issues identified.
(The use of internal auditors to provide direct assistance is prohibited in an ISAs (UK) audit (ISA (UK) 610)Why: internal auditors help to ensure the systems and controls are in place to maintain the integrity of the financial statements and have a good understanding of how they work.
What does this mean: internal auditors know the company’s accounting systems very well. By working with them, external auditors can better understand how things work, get answers to queries and help make sure any suggested improvements are put into practice.
How: discussions during all stages of the audit.
-
Management
What: identifying appropriate sources of audit evidence and providing constructive challenge on specific transactions or estimates
Why: management has responsibility for the conduct of the entity’s operations and for the preparation of the financial statements.
What does this mean: auditors typically give management a list of required audit evidence at the outset and may update this list as the audit progresses. Depending on the audit firm, requests for information can be made through a secure system, email, or in hard copy format. Frequent communication with management during the audit allows for a constructive working relationship. The auditor is required to exercise professional scepticism and should be prepared to appropriately challenge management, for example, assessing the appropriateness of assumptions used.
How: verbal discussions and written exchanges.
-
Group, component or overseas auditors
What: two-way communication between group and component auditors
Why: to enable the group auditor to effectively direct and supervise the work of component auditors and evaluate the adequacy of work undertaken. To give component auditors the opportunity to clarify their understanding of the group audit instructions and communicate significant matters arising.
What does this mean: good communication between the group auditor and the component auditor helps the group auditor oversee and review the work and lets the component auditor ask questions. This makes the whole audit process run more smoothly.
How: either verbally or in writing.
Reporting and completion
-
Those charged with governance
This includes executive directors, non-executive directors and members of the audit committee
What: significant audit findings, including significant deficiencies in internal control identified by the auditor during the audit
Why: to assist those charged with governance in fulfilling their oversight responsibilities (ISA (UK) 260 and 265).
What does this mean: while carrying out audits, auditors might find problems with a company’s internal controls. When this happens, they let those in charge know. These problems are usually found either by testing how the controls work or by noticing mistakes that show the controls didn’t work properly.
How: significant findings should be communicated in writing, if in the auditor’s professional judgement, oral communication would not be adequate (ISA (UK) 260.) Significant deficiencies in internal control should be communicated in writing (ISA (UK) 265). Other matters can be communicated orally or in writing (ISA (UK) 260).
What: if the entity reports on how it has applied the UK Corporate Governance Code, or why it has not, the auditor should communicate information regarding the audit committee’s responsibilities under the Code in relation to audit, risk and internal control; and the rationale and evidence behind significant judgements made during the course of the audit.
Why: the auditor has a responsibility to inform those charged with governance of important observations from the audit that are pertinent to their role in overseeing the financial reporting process, and promote effective two-way communication between the auditor and those charged with governance (ISA (UK) 260 9d, 16-1).
What does this mean: The UK Corporate Governance Code requires some listed companies to explain how they have complied with the Code. Auditors provide the audit committee with:
- any information that might help the board or audit committee with their responsibilities under the Code, such as the auditor’s views on significant accounting policies, business risks, materiality, and similar topics; and
- details about the information the auditor relied upon to make important judgements and ultimately form their opinion.
How: significant findings should be communicated in writing, if in the auditor’s professional judgement, oral communication would not be adequate (ISA (UK) 260). Other matters can be communicated orally or in writing (ISA (UK) 260). The auditor is usually invited regularly to audit committee meetings. The audit committee will meet the auditor without management present at least annually.
-
Audit committee (if PIE)
What: additional report including the results of the audit, the methodology used, the valuation methods applied, significant deficiencies in internal controls and more
Why: this is an ISA requirement. The content of the report is detailed in ISA (UK) 260 paragraph 16-2 and the format in paragraph 20-1. ISA (UK) 260 further requires that the additional report to the audit committee states whether or not significant deficiencies in controls have been resolved by management.
What does this mean: for PIEs, an additional report is required to be submitted to the audit committee explaining the results of the audit. This report is very detailed, and the exact contents are set out in auditing standards.
How: written report followed by discussion of key matters in the report if requested.
-
Management
What: financial statement adjustments; significant matters arising
Why: management has responsibility for the conduct of the entity’s operations and for the preparation of the financial statements. The auditor is required to communicate all misstatements found during the audit with management (ISA (UK) 450.The auditor is required to communicate deficiencies in internal control to management and those charged with governance (ISA (UK) 265).
What does this mean: The auditor categorises adjustments as material or not material. Material adjustments are typically made, while immaterial ones are accumulated to assess their aggregate impact. Both types are reported to management and those charged with governance. A 'management letter' is usually sent to management detailing the deficiencies found in internal controls during the audit.
How: verbal discussions and written exchanges.
-
Shareholders/members
What: the auditor’s opinion on whether the annual accounts give a true and fair view; have been properly prepared in accordance with the relevant financial reporting framework; and have been prepared in accordance with the requirements of the Companies Act 2006
(See Deconstructing the audit report for more details).
Why: under section 475 of the Companies Act 2006, it is a legal requirement for a company’s annual accounts to be audited unless exempt. Section 495 requires a company’s auditor to report to the company’s members and provides details of the contents of the report. The International Standard on Auditing (ISA) (UK) 700 outlines the auditor’s responsibility to form an opinion on the financial statements and specifies that the report should be in writing.
What does this mean: this is the main 'product' of the audit. It is the way in which the auditor can communicate the work they have done and the results they have found. The extended audit report was introduced in 2013 as a means of delivering more informative audit reports and sparking conversations with investors. Three main requirements were introduced in relation to information on key audit matters, materiality and audit scope.
How: the written independent auditor’s report. The auditor's report is also sent to Companies House as part of the filing of the annual report and is publicly available.
Resignation
-
Those charged with governance
This includes executive directors, non-executive directors and members of the audit committee.
What: notice of resignation sent to the company
Why: Companies Act 2006, section 516 requirement.
What does this mean: companies legislation requires auditors to send a letter of resignation to the company when they resign. A section 519 statement may also be required (see below in Companies House section)
How: written letter.
-
Companies House
What: reasons for an auditor’s resignation and any matters to be brought to the attention of members and creditors
Why: to provide clarity and essential information to successor auditors, regulators and other stakeholders about the circumstances surrounding an auditor’s resignation including any disagreements (section 519 and section 522, Companies Act 2006).
What does this mean: if an auditor resigns during their office term, they may need to issue an section 519 statement. This is always required for PIEs. For other entities it will depend on whether the reasons for resignation are exempt and whether there are any matters to report. These statements can provide valuable information to assist prospective audit firms in evaluating risk and making informed acceptance decisions.
How: Section 519 statement (PIEs and other companies unless exempt or where there are matters to report).
-
Financial Reporting Council (FRC)
What: PIE audits: for an audit firm and responsible individual (RI) to take on a PIE audit, they must be registered with the FRC. When appointed to undertake the audit of a PIE, they must notify the FRC of this “relevant change”.
Why: the FRC maintains a searchable database on its website of firms and RIs eligible to perform audit work on PIEs.
What does this mean: PIE audit firms and RIs must be registered with the FRC and notify both the FRC and ICAEW if they take on a new PIE audit.
How: in writing
-
ICAEW
What: Non-PIE audits: if an audit firm takes on a complex or high-risk audit, they must notify ICAEW
Notification will be required if a firm is appointed auditor to:
- a listed entity;
- an entity with turnover greater than £750 million, or which is an Other Entity of Public Interest under the FRC Ethical Standard;
- entities where the expected first year audit fee for the entity/group/collection of entities under the same beneficial owner or controlling party is more than twice the firm’s existing highest audit fee, subject to a de minimis of £25,000 for the first year audit fee; or
- an audit where the audit firm has three or fewer responsible individuals and the audited entity (or group or entities under common beneficial ownership or control) has combined turnover greater than £750 million.
Notification will not be required for audits where the firm already has to notify the FRC of the appointment (this applies for audits of PIEs and other audits retained by the FRC). Please see New 2025 Audit Regulations: notification requirements and sole practitioner alternates. Firms with substantial experience and capability in carrying out these audits can apply to the Audit Registration Committee (ARC) for a waiver.
Why: to help ICAEW monitor changes in risk profile across ICAEW-registered audit firms, including identification of firms that have recently accepted appointment to audits that are potentially of a higher complexity or greater public interest. (UK Audit Regulations 3.15 and 3.15A – 3.15D).
What does this mean: if a firm takes on a complex or risky non-PIE audit, they must notify ICAEW.
How: in writing/online form.
Ad-hoc
-
Regulators
(The Financial Reporting Council (FRC), HMRC, Prudential Regulation Authority (PRA), Charity Commission)
What: separate reports as required, for example, suspicious activity report (SAR)
Why: where required by law or regulation, such as to report suspicions of money laundering, or written reports to, for example, the PRA. For auditors of regulated entities, reporting responsibilities under ISA (UK) 250 B.
What does this mean: auditors have responsibilities under both law and auditing standards to report certain matters that come to their attention to other regulators.
How: written communications as appropriate.
-
Creditors/lenders
What: information on the financial position and performance of the company
Why: third parties that extend credit or provide loans to companies may require a copy of audited financial statements to ensure, for example, banking covenants are not breached.
What does this mean: although auditors' reports are addressed to shareholders, external parties like banks frequently request audited financial statements to verify a company's finances. The auditor's report is often seen as validation of the accounts.
How: audited financial statements.
-
Investors
What: preliminary announcements made by the company
Why: to provide investors with a timely summary of results.
What does this mean: companies often issue preliminary results of the company. In practice these would not be issued without the consent of the auditor.
How: stock exchange announcements, press releases, websites, audited financial statements.
What: interim financial statements
Why: to provide timely insights into the company’s financial performance and position between annual reporting cycles. Auditors are often asked to perform an independent review of the interim financial information under International Standard for Review Engagement (UK) 2410 (ISRE (UK) 2410).
What does this mean: companies will often produce quarterly or half-yearly financial statements. These are not audited but auditors may be asked to perform a different type of review on this information which involves less extensive procedures than an audit.
How: stock exchange announcements, press releases, websites, audited financial statements.
Please note that for smaller entities and owner-managed businesses, the communication may be less structured and the distinction between shareholders, those charged with governance and management may be less clear cut.
References above to written instructions may also be delivered through online portals, with signatures obtained using software such as DocuSign.
Disclaimer
This content is being provided for information purposes only. ICAEW will not be liable for any reliance you place on the information in this material. You should seek independent advice.
Auditor Reporting Lab
ICAEW takes a deep dive into the language, content and format of auditors' reports to understand how we can enhance their value in the context of auditor and corporate communications.
Further resources
Audit in depth
In-depth guidance on completing all stages of an audit as well as how to make the decision as to whether or not an audit is required.
Find out more
Audit reports
Understand how to prepare an audit report for an array of different circumstances, sectors and legislation.
View