Audit monitoring FAQs

We may visit you at any time, but we must visit all firms at least once every six years. As required by the Audit Regulation and Directive (ARD), we use a risk-based approach to select firms for their next visit. The various factors for consideration include:

• the size and complexity of the firm;
• its RSB-scope audit clients; and
• previous regulatory history.

Your firm’s next visit date will depend on this risk-based selection approach. You may have your next visit on or just before the six-year anniversary of your previous visit, but this is not an automatic default or right under the ARD. You may find we visit you more frequently for the reasons set out above. We will notify you when your firm has been selected for a visit.

Where we expect to review more than one audit file, we schedule a two-day visit. This is to allow time for our review and also adequate time for you to consider any questions we have and discuss them with us during the visit.

We grade audit visits by outcome. There are a range of outcomes:

• visit closed without follow-up action;
• some further follow-up action; or
• detailed report to the Audit Registration Committee.

Audit quality is one component of the overall visit outcome. If the reviewer has concerns about the ability of a firm to make necessary improvements, we will recommend some form of follow-up action (such as submission of cold or hot file reviews) to the Audit Registration Committee. The most significant failings we find relate to gaps in audit evidence and judgements.

Our reviewers are not able to commit to a grading or outcome at the closing meeting stage. This is because the final decision will depend partly on the firm’s formal responses and any questions raised in our quality control processes. However, reviewers should be able to give your firm an indication of the likely range of outcomes. You can find more information about audit quality and visit outcomes in our audit monitoring reports, which you can read and download from icaew.com

We have separated audit monitoring visits from other visits such as reviews for Practice Assurance and the monitoring of DPB (Investment Business) licence holders.

Our approach to visits has not changed but we also conduct some off-site monitoring telephone reviews for firms with no audits and mid-cycle reviews for some other firms.

We have used electronic documentation rather than paper-based files for over 10 years, and we continually review our working methods and practices to ensure an effective monitoring process.

We aim to select files that show how firms respond to the risks and challenges they face in performing audits.

If charities (for example) represent a significant proportion of audit assignments, or individual charity audits are significant, we may well decide to select a charity file.

However, we may review a charity file because a firm performs very few charity audits as there may be issues around familiarity with the specialist accounting and audit requirements. In these cases the review may be focused on certain aspects of the specialist audit work.

We aim to select enough files for review to cover the major risks in the firm’s audit activity. The sample will depend on factors such as:

• the number of responsible individuals;
• the nature, scope and results of the firm’s compliance review process; and
• the number and type of public interest and higher-risk clients.

We generally review a minimum of two audit files, but may only review one file if the firm has a very small audit client portfolio.

External cold file reviews can provide a good picture of audit quality at a firm. Smaller firms find them particularly useful to check their compliance with audit regulations and use of their audit system. We see external reviews at firms as a positive commitment to audit quality.

We consider the results of cold file reviews when selecting our file review sample. For internal and external cold file reviews we may assess the reliability of the review by a direct re-performance or by looking at an audit file for the year following a review. The latter approach also helps us to assess if the firm has taken appropriate remedial action following a cold file review.

We do not require or expect firms to retain cleared review queries on the audit file. Firms sometimes retain review queries to record audit evidence but it may be preferable to amend and update the audit working papers.

Smaller firms do not generally need complex policies and procedures, and may rely on generic documents from a proprietary audit compliance manual. Firms should tailor generic documents to suit their own circumstances.

Sometimes policies and procedures may not cover all relevant areas, for example:

• policies and procedures relating to consultation;
• resolution of differences of opinion;
• when and how to obtain an engagement quality control review (EQCR); and
• procedures to address independence threats.

Although ISQC1 states cold file reviews should be done by someone independent of the audit team, you may find this impractical. Where this is the case, it is still acceptable to do your own reviews as long as they are effective and you have an external cold file review at least once every three years.

Most of our reviewers are employed by, and work exclusively for ICAEW. We also have a small number of subcontractors who work on a freelance basis. All of our reviewers are suitably qualified and have appropriate experience. They all sign annual fit and proper, independence and confidentiality declarations.

A popular question and one to which there is no easy answer. Our annual audit monitoring reports will give you some insights into what we find on our reviews. You can read and download recent audit monitoring reports from icaew.com