UK Audit Reform: Audits of Internal Controls Over Financial Reporting

An Essential, But Missing Reform

In our previous blog, UK Audit Reform—Investors Attempt to Assess the Net Effect and Timing of the Proposed Reforms: Has the “Expectations Gap” Been Narrowed?, we note that CFA Institute submitted a response to the UK Department for Business, Energy, and Industrial Strategy (BEIS), Restoring Trust in Audit and Corporate Governance: Consultation on the Government’s Proposals (the “Consultation”).

In that blog, we highlight our overall assessment of the net effect of the reforms, specifically highlighting that the most significant instrument of reform is an empowered audit regulator, replacing the Financial Reporting Council with the new Audit Reporting and Governance Authority (ARGA). We note, however, that ARGA has many stakeholders to please and a long to-do list that lacks a timetable. We also demonstrate the challenge investors and other stakeholders have in assessing the net effect of the reforms or understanding when that assessment can be considered complete. In our view, although some of the proposals in the Consultation present bold new approaches, overall, it falls a bit short of the original promise of this nearly three-year-long endeavor. It remains challenging to determine whether the “expectations gap,” so widely spoken about when assessing audit quality, has been narrowed.

One big area of disappointment for investors is the UK government’s failure to adopt a combination of management certifications and auditor attestations as to the effectiveness of the internal controls over financial reporting (ICFR). Such ICFR measures have been an important driver of investor confidence in the integrity of financial reporting in other regions of the globe, including but not limited to the United States. In failing to adopt such measures, it is our view, that the UK government has failed to ensure that the UK market is globally competitive on audit quality.

Audit Quality Depends on the Effectiveness of Internal Controls: The Absence of Management Certifications and Audits of Internal Controls Is Disappointing

As the Consultation notes, “Confidence in company reporting depends on the effectiveness of the internal controls and risk management processes.” This is why, in late 2019, we provided a separate letter to BEIS, following the Brydon Review, supporting this key reform. In complex businesses, testing of, and confidence in, internal controls is an essential element of the audit. As such, auditor reporting on internal control work is something investors have found useful. Furthermore, assurance is an important driver of confidence in the integrity of financial statements and in the fairness of our capital markets.

CFA Institute has long been supportive of an evaluation by both management and the auditor as to the effectiveness of ICFR. We have found that the report of the assessment of internal controls by management (SOX Section 404(a))—along with the attestation of the disclosure controls and procedures (SOX Section 302)—has revealed an effective behavioral change for management. These laws, which clearly place accountability (and legal liability) for internal controls over accounting and financial reporting with the principal officers of the company, have had the effect of increasing the resources necessary to enhance financial reporting. Consequently, these certifications have made upper management accountable for providing resources and for giving attention to these important elements of financial management.

The absence of any meaningful proposals to strengthen the accountability and the oversight of internal controls is disappointing.

UK Government Options Sow Confusion and a False Sense of Comfort

Management Self-Assessments. The Consultation rejected many of the Brydon Review suggestions. Furthermore, the Consultation provides for options that, in our view, represent minor incremental changes over the status quo and do little to significantly advance the current landscape. The options presented in the Consultation are not sufficient because they essentially amount to a self-assessment, and one that does not require monitoring or measuring control risks associated with financial reporting. Additionally, management knows that such assessments will not be challenged by the auditor if there is no audit of the ICFR.

The UK government’s proposal is disappointing. In our view, it may provide investors with a false sense of comfort about the strength of an entity’s ICFR, when in fact no transactional testing may have been performed (e.g., assessing the “design” or the “entity” level controls).

As we evaluate the dialogue among stakeholders on these options, we have noted confusion and a misperception or misunderstanding about what the UK government’s proposal will actually entail and accomplish relative to standards on management attestation and audits of ICFR in other jurisdictions.

Audits of ICFR Are More Meaningful Than an Understanding of Internal Controls in a Financial Statement Audit. We believe auditors should provide an audit opinion on their assessment of internal controls—not simply a communication reflecting their views on internal controls tested as a part of the financial statement audit. In a financial statement only audit, the auditor obtains an understanding of internal controls that is sufficient to assess the factors that affect the risks of material misstatement and to design further audit procedures. In an ICFR audit, however, the auditor’s objective is to express an opinion on the effectiveness of the company’s ICFR.

UK Government Must Reconsider to Be Competitive

We believe the UK government should reconsider this element of the Consultation because the United Kingdom is lagging other jurisdictions on this important aspect of audit quality, which makes it less competitive in the pursuit of investment capital, thus increasing the cost of capital. Recent literature indicates that firms exempt from the attestation requirements can make additional common equity more costly.

Cost: The False Narrative and a Price Investors Are Willing to Bear

The narrative that management and auditor assessment of internal controls of financial reporting is too expensive is one that previously existed in the US market. It is a very common, but undemonstrated, narrative regarding virtually every accounting, disclosure, and audit reform. Investors view the benefits of ICFR audits as exceeding the costs. The US market has seen a reduction of restatements and blowups (like Carillion) over the past two decades. Investors are in near-unanimous agreement that ICFR management attestations and audits have demonstrated they are cost effective.

This behavioral change in management and auditors’ responsibilities is a benefit that is vastly underestimated in this cost-benefit analysis. Investors in other jurisdictions have roundly supported these ICFR measures, and it is these investors—who are the residual owners of the company—who pay such costs. They are willing to pay for better ICFR.

Photo credit @ Getty Images / imamember