6 ISSB General Update

The report confirms that:

• New corporate governance reporting requirements will be introduced, including an annual “Audit and Assurance Policy” report for Public Interest Entities (PIEs). This will set out each PIE’s approach to internal and external audit, with boards required to explain how they have assured the effectiveness of internal controls.
• A new regulator, the Audit, Reporting and Governance Authority (ARGA), will be created as the successor to the FRC. It will have new powers, including to issue an Audit and Assurance Policy reporting standard (alongside associated guidance), and to enforce compliance with this.

In anticipation of ARGA’s new powers, the FRC has indicated its intention to produce a standard for Audit Committees on their responsibilities in respect of fraud, and to develop a standard for internal controls. The FRC has also suggested that it will revise the UK Corporate Governance Code (the Code) and its guidance, including that on Audit Committees (the AC Guidance). This will be considered in light of ARGA’s new functions and powers, and further market developments.

Against this backdrop, the Audit Committee Chairs’ Independent Forum (ACIF)¹ held a roundtable discussion on 29 June 2022 to discuss the future of the UK Audit Committee, in particular how its role will evolve as a consequence of the forthcoming legislative and regulatory changes. The discussion brought together a wide range of Audit Committee Chairs from PIEs across the FTSE 100, FTSE 250 and private companies, as well as representatives from the FRC, the Department for Business, Energy and Industrial Strategy (BEIS) and a selection of leading audit firms. This paper summarises the key themes arising from that discussion.

Setting the Scene

The roundtable opened with an acknowledgement that the proposed changes represent a pivotal moment for audit and corporate governance in the UK, creating an opportunity to reset the role of the Audit Committee and to shape the future of audit. Participants recognised that the Audit Committee is already a key forum for board oversight and challenge. Going forward, the Audit Committee will likely be at the heart of the new corporate reporting framework, with enhanced responsibilities that will require the right skill sets and resource to fulfil its evolving mandate.

Participants highlighted a number of areas where the Audit Committee’s role will be impacted, as well as several challenges that will need to be addressed as the new framework takes shape, including:

• The Audit Committee’s role in relation to the company’s new annual Audit and Assurance Policy report.
• The Audit Committee’s oversight of internal controls, with the introduction of a new internal controls standard.
• The Audit Committee’s oversight of ESG (Environmental, Social and Governance) reporting and assurance, as this continues to evolve.
• The Audit Committee’s role in managing the audit tender process, and how this will evolve with the introduction of managed shared audit.
• The Audit Committee’s role in assessing and reporting on audit quality, and in providing challenge to the external audit.
• The Audit Committee’s role in overseeing the risk management framework and related disclosures.

Key Themes

The Audit and Assurance Policy (AAP)

1The AAP will provide new reporting requirements for PIEs that will describe the company’s approach to internal and external audit, and to the assurance of its corporate reports. Participants discussed what this might entail, in particular the scope of the AAP and how it might be used to foster greater transparency and accountability in corporate reporting and audit.

Scope of the AAP

2The discussion highlighted that the scope of the AAP is not yet fully defined and that there is an opportunity to shape the final requirements. Participants raised a number of questions regarding the AAP’s scope, including:

1. Whether the AAP should apply only to PIEs, or whether it should be extended to other entities beyond the PIE definition (e.g., those with a broader public interest).
2. Whether the AAP should cover both internal and external audit, or whether it should focus primarily on external audit.
3. What level of detail should be included in the AAP, balancing the need for transparency with the risk of “boilerplate” disclosures.

3Participants generally agreed that the AAP should focus on the key areas of audit and assurance that are most relevant to investors and other stakeholders. They suggested that the AAP could be used to:

1. Explain the board’s overall philosophy on audit and assurance, and how it seeks to ensure the quality and effectiveness of both internal and external audit.
2. Provide transparency on the scope and coverage of internal audit, including its approach to identifying and addressing key risks.
3. Describe the process for selecting and overseeing the external auditor, including the approach to audit tenders and rotation.
4. Detail the board’s assessment of external audit quality, including the metrics and criteria used.
5. Outline the company’s approach to assuring other corporate reports, beyond the financial statements, such as ESG information.

Using the AAP to foster transparency and accountability

4Participants noted that the AAP provides an opportunity to enhance transparency and accountability. They suggested that the AAP could be used to:

1. Communicate the Audit Committee’s role and responsibilities more clearly to investors and other stakeholders.
2. Provide a clear narrative on the board’s assessment of audit quality, and the actions being taken to address any weaknesses.
3. Facilitate engagement with investors on audit and assurance matters, by providing a structured framework for dialogue.
4. Demonstrate the board’s commitment to strong corporate governance and effective oversight of audit.

Internal Controls

5The government’s response confirmed its intention to introduce new requirements for PIEs regarding internal controls, including an annual board declaration on their effectiveness. In anticipation of this, the FRC has indicated that it will develop a new standard for internal controls. Participants discussed the implications of these changes for the Audit Committee’s role, and the challenges that companies may face in implementing them.

The Audit Committee’s oversight of internal controls

6Participants generally welcomed the focus on internal controls, recognising their importance in providing reliable corporate reporting. They agreed that the Audit Committee has a critical role to play in overseeing the effectiveness of internal controls, including:

1. Reviewing the design and operation of the internal controls framework, including its scope, key controls, and monitoring processes.
2. Challenging management on the effectiveness of internal controls, and on the actions being taken to address any deficiencies.
3. Assessing the adequacy of resources allocated to internal controls, including the skills and experience of staff involved.
4. Overseeing the company’s internal controls reporting to the board and external stakeholders.

Challenges in implementing new internal controls requirements

7Participants highlighted a number of challenges that companies may face in implementing the new internal controls requirements, including:

1. The need to clearly define the scope of internal controls, and to distinguish between financial and operational controls.
2. The potential for increased costs and resource demands, particularly for companies that do not currently have a robust internal controls framework.
3. The need for appropriate guidance and training to support companies in implementing the new requirements effectively.
4. The risk of "checkbox" compliance, where companies focus on meeting the letter of the law rather than the spirit of effective internal controls.
5. The need to ensure that the internal controls framework is proportionate to the size and complexity of the company, and to the risks it faces.

8Participants emphasised the importance of avoiding a "one-size-fits-all" approach to internal controls, recognising that the specific requirements will need to be tailored to the individual circumstances of each company. They suggested that the FRC’s new standard for internal controls should provide flexibility and guidance, rather than a rigid set of rules.

ESG Reporting and Assurance

9The government’s response highlighted the growing importance of ESG reporting and assurance, and the need for greater clarity and consistency in this area. Participants discussed the implications of these developments for the Audit Committee’s role, and the challenges that companies may face in overseeing ESG reporting and assurance.

The Audit Committee’s oversight of ESG reporting and assurance

10Participants generally agreed that the Audit Committee has an important role to play in overseeing ESG reporting and assurance, given its existing responsibilities for financial reporting and risk management. They suggested that the Audit Committee’s role could include:

1. Reviewing the company’s ESG reporting framework, including its scope, key metrics, and reporting processes.
2. Challenging management on the completeness and accuracy of ESG disclosures, and on the actions being taken to address any weaknesses.
3. Assessing the adequacy of resources allocated to ESG reporting and assurance, including the skills and experience of staff involved.
4. Overseeing the company’s engagement with external assurers of ESG information, and the quality of their work.

Challenges in overseeing ESG reporting and assurance

11Participants highlighted a number of challenges that companies may face in overseeing ESG reporting and assurance, including:

1. The evolving nature of ESG reporting standards and frameworks, and the need to keep up-to-date with new developments.
2. The lack of consistent and comparable ESG data, making it difficult to benchmark performance and to provide meaningful disclosures.
3. The potential for "greenwashing" or misleading ESG claims, and the need for robust assurance to mitigate this risk.
4. The need for appropriate skills and expertise on the Audit Committee to effectively oversee ESG reporting and assurance.
5. The difficulty of integrating ESG information with financial reporting, and ensuring a holistic view of the company’s performance.

12Participants emphasised the importance of a clear and consistent approach to ESG reporting and assurance, and the need for greater collaboration between companies, regulators, and assurance providers to achieve this.

Audit Tender Process and Managed Shared Audit

13The government’s response confirmed its intention to introduce managed shared audit for FTSE 350 companies, with the aim of increasing competition and choice in the audit market. Participants discussed the implications of this for the Audit Committee’s role in managing the audit tender process, and the challenges that companies may face in implementing managed shared audit.

The Audit Committee’s role in managing the audit tender process

14Participants agreed that the Audit Committee has a critical role to play in managing the audit tender process, to ensure that the company selects a high-quality external auditor that is independent and objective. They suggested that the Audit Committee’s role could include:

1. Defining the scope and objectives of the audit tender, and the criteria for selecting a new auditor.
2. Overseeing the tender process, including the evaluation of proposals and the selection of a preferred bidder.
3. Engaging with potential auditors, and challenging them on their approach to audit quality and independence.
4. Making a recommendation to the board on the appointment of the external auditor.

Challenges in implementing managed shared audit

15Participants highlighted a number of challenges that companies may face in implementing managed shared audit, including:

1. The complexity of managing two audit firms, and ensuring effective coordination and communication between them.
2. The potential for increased costs and resource demands, particularly in the initial stages of implementation.
3. The need for clear roles and responsibilities between the two audit firms, and a robust framework for resolving any disagreements.
4. The risk of reduced accountability, where each audit firm may feel less responsible for the overall audit quality.
5. The need for appropriate guidance and support from regulators to ensure that managed shared audit is implemented effectively.

16Participants emphasised the importance of a well-designed and carefully implemented approach to managed shared audit, to ensure that it achieves its objectives of increasing competition and choice, without compromising audit quality.

Audit Quality and External Audit Challenge

17The government’s response highlighted the need for greater focus on audit quality, and for Audit Committees to provide more robust challenge to the external audit. Participants discussed the implications of these developments for the Audit Committee’s role, and the challenges that companies may face in assessing and reporting on audit quality.

The Audit Committee’s role in assessing and reporting on audit quality

18Participants agreed that the Audit Committee has a critical role to play in assessing and reporting on audit quality, to ensure that the external audit is effective and provides reliable assurance. They suggested that the Audit Committee’s role could include:

1. Defining key metrics and criteria for assessing audit quality, and regularly monitoring the external auditor’s performance against these.
2. Engaging with the external auditor on their audit plan, and challenging them on their approach to identifying and addressing key risks.
3. Reviewing the external auditor’s findings and recommendations, and challenging them on the robustness of their conclusions.
4. Providing a clear narrative in the annual report on the board’s assessment of audit quality, and the actions being taken to address any weaknesses.

Challenges in providing robust challenge to the external audit

19Participants highlighted a number of challenges that companies may face in providing robust challenge to the external audit, including:

1. The need for appropriate skills and expertise on the Audit Committee to effectively challenge the external auditor.
2. The potential for a perception of conflict of interest, where the Audit Committee is responsible for both appointing and challenging the external auditor.
3. The difficulty of obtaining independent evidence on audit quality, and of comparing the performance of different audit firms.
4. The need for a culture of constructive challenge, where the Audit Committee and the external auditor can engage in open and honest dialogue.
5. The risk of over-reliance on the external auditor, and the need for the Audit Committee to maintain its own independent judgement.

20Participants emphasised the importance of a strong and independent Audit Committee, with the right skills and expertise, to effectively challenge the external audit and to ensure high-quality assurance.

Risk Management Framework and Related Disclosures

21The government’s response reiterated the importance of effective risk management, and the need for clear and comprehensive disclosures on the company’s principal risks and uncertainties. Participants discussed the implications of these developments for the Audit Committee’s role, and the challenges that companies may face in overseeing the risk management framework and related disclosures.

The Audit Committee’s oversight of the risk management framework

22Participants agreed that the Audit Committee has a critical role to play in overseeing the risk management framework, to ensure that the company effectively identifies, assesses, and manages its principal risks. They suggested that the Audit Committee’s role could include:

1. Reviewing the design and operation of the risk management framework, including its scope, key processes, and reporting lines.
2. Challenging management on the identification and assessment of principal risks, and on the actions being taken to mitigate them.
3. Assessing the adequacy of resources allocated to risk management, including the skills and experience of staff involved.
4. Overseeing the company’s risk disclosures in the annual report, ensuring they are clear, comprehensive, and balanced.

Challenges in overseeing risk management and disclosures

23Participants highlighted a number of challenges that companies may face in overseeing the risk management framework and related disclosures, including:

1. The dynamic nature of risks, and the need for the risk management framework to be agile and responsive to changing circumstances.
2. The difficulty of quantifying and comparing risks, particularly for emerging and non-financial risks.
3. The potential for "boilerplate" risk disclosures, where companies provide generic information rather than specific and meaningful insights.
4. The need for appropriate skills and expertise on the Audit Committee to effectively oversee risk management.
5. The challenge of integrating risk information with other corporate reports, and ensuring a coherent narrative on the company’s performance and prospects.

24Participants emphasised the importance of a robust and forward-looking risk management framework, supported by clear and comprehensive disclosures, to provide investors and other stakeholders with a clear understanding of the company’s risk profile and its approach to managing them.

Conclusion

The roundtable discussion highlighted the significant implications of the forthcoming legislative and regulatory changes for the UK Audit Committee. Participants agreed that the Audit Committee’s role will evolve, with enhanced responsibilities in areas such as the Audit and Assurance Policy, internal controls, and ESG reporting and assurance. They emphasised the importance of having the right skill sets and resources on the Audit Committee to fulfil its evolving mandate, and the need for clear guidance and support from regulators to ensure that the new framework is implemented effectively.

The discussion also underscored the opportunity that these changes present to reset the role of the Audit Committee and to shape the future of audit and corporate governance in the UK. By embracing these changes, Audit Committees can play an even more critical role in fostering transparency, accountability, and trust in corporate reporting.

Footnotes