Introduction

In March 2023, the FRC published the 23-26 Plan which re-prioritises work to reflect the delay in the anticipated legislation to create the Audit, Reporting and Governance Authority (ARGA). This is the second 3-Year Plan published by the FRC; the first, the 2022-25 Plan, introduced the four faces regulatory approach:

(a) System Partner

(b) Supervisor

(c) Facilitator

(d) Enforcer

In this briefing we consider the impact of the 23-26 Plan on the FRC's enforcement strategy and associated deliverables for the next three years.

FRC enforcement strategy

The 23-26 Plan for the FRC's enforcement division builds on the 2022-25 Plan, in which the FRC committed to new responsibilities in relation to the embedding of, and training in, new enforcement policies to reflect significant revisions to the Audit Enforcement Procedure and the design and delivery of changes to support effective implementation of the enforcement aspects of regulatory reform.

The 23-26 Plan also reiterates the FRC's continued or increased focus in certain areas of work, including:

(a) supervision liaison to support what the FRC terms as 'Constructive Engagement' activities (essentially a process to deal with cases where the audit quality concerns can be appropriately addressed by agreeing remedial action with the firm without the expense of a full investigation) and increasingly sophisticated 'Non-Financial Sanctions', such as a prohibition or a notice requiring the respondent to cease or abstain from repetition of the conduct giving rise to the breach;

(b) monitoring of the increasing number of Non-Financial Sanctions already imposed;

(c) further recruitment, including in anticipation of the increase in investigations due to the increased risk on audit reporting quality arising from current geopolitical and economic turmoil;

(d) input from experienced auditing or accounting professionals at an earlier stage in the process;

(e) operational resourcing to accommodate an increase in the size of the division; and

(f) stakeholder engagement with regulated persons.

The following key themes appear to prevail throughout the 23-26 Plan:

(a) the FRC's expectation that there will be an increase in the volume of enforcement cases flowing from current economic volatility; according to the FRC's website, at the time of writing seven investigations have been announced since the start of this year and given the FRC's comments in the 23-26 Plan we anticipate that this will steadily increase as we approach the second half of the year. Continuing economic volatility including the effects of inflation will continue to impact audited entities, creating particular challenges (and opportunities) which will need to be navigated carefully with a view to mitigating the risk of an investigation (which can have considerable impact on employees and senior management time and resources, as well as on the reputation of the firm, even if the investigation is ultimately closed with no further action or sanction imposed); and

(b) the intention to continue using Constructive Engagement with firms as an "increasingly useful approach" to dealing with cases where the FRC considers that its concerns can be appropriately and satisfactorily addressed without the time and expense of going through the full investigation process. The case may be referred back to the supervision team to undertake Constructive Engagement which may result in enhanced monitoring and/or agreeing certain remedial action for example, until such time as the FRC considers the risks relating to the audit firm's poor conduct has been addressed.

The increased focus on Constructive Engagement is perhaps taken into account in the reduction in budgeted headcount for the enforcement division by March 2024 (falling from a total headcount of 86 to 80 from the March 2023 budget) which the FRC says reflects the "reduction in the case portfolio through improved timeliness of case resolutions". However, elsewhere in the 23-26 Plan the FRC also suggests that an increase in headcount for the enforcement division has simply been "deferred" to reflect current case load and longer-term anticipated increase in case volumes.
The FRC's enforcement key performance indicator (KPI) is a period of two years between commencement of an investigation and the service of either the proposed formal complaint or investigation report (or closure or settlement if sooner), however only 40% of enforcement case investigations concluded, settled, or closed within this two-year target in the year 2021-2022. The full year performance for the 2022-23 financial year will be published in the FRC's annual report and accounts in July 2023, but interestingly, the KPIs for the half year performance for the current financial year suggests that progress is already being made, with 44% of enforcement case investigations having met the two-year target so far.
Finally it is worth noting that the 23-26 Plan highlights the importance of enforcement for supporting root cause analysis that can be used to inform quality improvement plans or inform subsequent policy and supervisory work, as well as ensuring that those responsible for misconduct are held to account. The FRC's priorities and deliverables for a "timely and proportionate" enforcement regime over the next three years are:

(a) fair, robust, timely case closures;

(b) upskilling and training;

(c) collaboration with the Department for Business and Trade on planned legislative change;

(d) upskilling to enable implementation of future powers arising from proposed regulatory reform in 2024 onwards; and

(e) publication of the Annual Enforcement Review to deliver transparency and drive improved behaviours through messaging of case outcomes.

The FRC notes that these deliverables will contribute in particular to the anticipated ARGA directors enforcement regime, perhaps a sign of things to come for the FRC's future enforcement strategy.

Practical steps

Drawing on experience and our lessons learned from advising clients when responding to supervisory intervention and enforcement proceedings, we have set out below a reminder of some key points to assist firms and senior managers to mitigate against escalation of regulatory intervention and/or manage enforcement investigation by the FRC (and other regulators):

(a) Responding to regulatory enquiries: The timeliness and manner of a firm's response to an information requirement or query from the regulator can set the tone of the relationship from the outset. The approach taken will clearly need to be tailored to the circumstances of the case, avoiding a one-size-fits-all approach. Where possible, responding in a helpful but proportionate manner and being open about any challenges that the line of enquiry may present (for instance in terms of resourcing or time taken to respond) can assist in narrowing or refining the scope of the enquiry in the first instance.

(b) Consider obligations to notify: In light of a regulatory enquiry and/or an internal escalation or investigation following self-identification of a potential issue or breach, firms must be alive to their potential obligations to make a regulatory notification of matters of material significance as soon as practicable. Notifying early and being open and cooperative with the regulator may mitigate the risk of more muscular supervisory intervention or enforcement action further down the line.

(c) Prioritise governance and appropriate MI: A robust governance framework is key to providing the requisite checks and balances to management and identifying risks early to avoid escalation of detriment to the firm and its clients; whilst it may seem obvious that sufficiently quantitative and qualitative management information (MI) are intrinsic to good reporting and governance arrangements, firms may wish to consider (to the extent they do not do so already) including recent FRC enforcement trends and "lessons learned" in the collation and reporting of their MI. Monitoring enforcement action published against others can be a helpful tool in identifying potential gaps or early warning signs in firms' own systems and controls and considering appropriate remedial action or any enhancements that may need to be made (before it comes to the attention of the FRC or becomes significant enough to merit a regulatory notification).

(d) Privilege: Regulators may request a waiver of privilege over material they consider relevant to their investigation, for example in relation to legal advice that the firm has received in relation to the matters under investigation. A decision to waive privilege needs to be weighed carefully with the benefit of advice as there can be both advantages and risks in doing so.

(e) Record keeping: Firms should keep records of decisions and steps taken both during and following any regulatory intervention or enquiry, ensuring all of the points set out above are documented appropriately including any communication (whether oral or in writing) with the regulator and/or other law enforcement authorities.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.