The role of audit risk officer was created last year as part of an initiative to broaden the nature and scope of ICAEW’s monitoring of audit firms as they navigate an increasingly turbulent market.
“My role is about leading the proactive identification and monitoring of audit risks within ICAEW registered audit firms as they occur,” explains Rebecca Carr, who took up the audit risk officer post last summer. “It sits within a wider initiative to try and get better visibility on the movement of audits between firms and greater proactivity in monitoring.”
Between cycles
In essence, the audit risk officer is there to support, add to and complement the work that ICAEW’s Quality Assurance Department (QAD) already carries out. But Rebecca’s role is different in that she is engaging with firms earlier in the audit process and providing them with support to better manage any potential risks.
“QAD visits are usually retrospective,” she explains. “They're largely looking at audits that have already happened whereas I am looking prospectively, using media, risk profiling and other intelligence to follow risks as they occur in between cycles".
The audit market is currently in a volatile phase, which is raising additional challenges for firms and their clients. With some of the biggest firms de-risking their current portfolio, this might mean potentially complex and challenging audits moving to smaller or less experienced firms.
“This might be perfectly okay, and it is important that we encourage a competitive audit market” says Rebecca. “But it could be that the firms taking on the audit might not have the capability, experience or resources to do that job to the best of their ability and to the quality that's required.”
Part of the audit risk officer’s role is to look out for unusual movements of audits outside the natural course of the tender process that might perhaps raise concerns. “I then contact the firm taking on the audit to discuss what procedures they have in place to mitigate any quality risks,” explains Rebecca.
“We hope they either have those plans in place and there’s no issue, or that me speaking to them prompts them to think about what they’re doing more carefully and put plans in place. Either way, quality is improved and any potential findings for QAD next time would be minimised.”
Data, data and more data
As an improvement regulator, ICAEW’s aim is to raise standards and support its firms in carrying out high quality work. “My role is intended to be supportive,” stresses Rebecca. “I'm having discussions about the risks and prompting firms to think about these as they arise, rather than coming in afterwards and saying you didn't do X, Y or Z, or we have found this or that problem.”
She contacts firms based on intelligence she’s gathered and any risks she has identified. “We have access to a lot of data both within and outside ICAEW” she explains.
“If you assess data and trends standalone, or analyse information from annual returns and cessation statements individually, you might see one small potential risk emerging. But if you combine all the information you have together, it can make you sit back and think: We should probably look at that.”
As the role develops, she plans to further systemise the way she gathers all this data and uses it to identify risk. “Really it's about ending up in a position where I've got real time data exception reporting,” she says. “That's where I see it getting to.”
Sharing insights
Another key part of the audit risk officer’s role is sharing insights with firms. This might be anything from alerts about the latest risks in the audit market to best practice when taking on new audits and checking firms know how to handle auditor resignations correctly.
As well as providing tailored information and advice to firms during calls and visits, Rebecca is writing articles to share more general points, good practice tips and news. “It's not just about the monitoring, it's also sharing insights with firms,” she emphasises.
A recent article on good practice looked at what's come out of recent monitoring visits. “We’re communicating with firms about what they can do, from the beginning, before they’re even thinking about taking an audit, all the way through to the ongoing monitoring once the audit is underway,” she says. “And this links well into their ISQM 1 processes, which is very topical at the moment.”
Recognising the benefits
It’s early days, and some firms are not yet familiar with the audit risk officer role. “At the moment I'm having to explain what my role is first,” she says. “But once I do, firms get really engaged, and the reason for that is because they see the benefit.”
“It's about tracking the risk,” she adds. “By checking in on that risk, or seeing if there's anything that can or should be done to mitigate it, audit firms can see the benefits of that straight away. It's a completely different angle; it's not necessarily something that they've already done wrong.”
Rebecca’s latest risk alerts, market insights and good practice guidance are published in ICAEW Regulatory & Conduct News and on icaew.com/regulatorynews.