Academy external auditors and internal scrutiny work

The new Ethical Standard 2019 places additional restrictions on the services that an external auditor can provide to their audit clients.  This includes an outright prohibition on the ability to provide internal audit services.  This change will have significant implications within the academies sector, where many firms of external auditors have been providing services akin to internal audit for some time.  This Q&A looks at some of the changes required as a result of the new prohibition.

I provide ‘internal scrutiny’ not ‘internal audit’ services, so this prohibition doesn’t apply to me, right?

Wrong.

As I have said on our academies courses and conferences for a number years, it doesn’t matter what you call these services, you need to look at the purpose of them.  ‘Internal assurance’, ‘internal scrutiny’, ‘responsible officer’ and all manner of creative naming elements are seen in practice.  If the purpose of the assurance provision is not external or the purpose of the firm calling the service something other than internal audit is to circumvent the requirements of the Ethical Standard, then it isn’t going to look ever so sharp from the viewpoint of an objective, reasonable and informed third party.  You have to apply the spirit of the Ethical Standard.  Circumvention is not what we are here for.

Does the revised scoping of academy trust internal scrutiny requirements make a difference?

Changes made to the Academies Financial Handbook back in 2019 around the scope of required internal scrutiny work make it far more difficult to argue that what is being provided, as a whole, doesn’t fall into the Ethical Standard definition of ‘internal audit services’.

Unlike the conditional prohibition in Ethical Standard 2016 which talked about placing a significant degree of reliance on the internal audit work or taking the role of management, the Ethical Standard 2019 completely prohibits the provision of internal audit services.

When do these changes take effect?

The new prohibition takes effect for audits of financial statements with periods commencing on or after 15 March 2020.  In the context of the academies sector, this essentially means that an external auditor providing internal audit services will need to have resigned from one or the other role by 1 September 2020.

There are some transitional rules, but they rarely apply, so we’ll leave them alone here.

We only undertake an extended programme of external audit work to help the trust cover the Handbook requirements.  Is that OK?

The revised Ethical Standard is similar to its predecessor version in this respect, insofar as it refers to the provision of both work that is a by-product of the audit, as well as work that might be regarded as an ‘audit related service’.

Firms have certainly used the latter over the years to argue that internal-scrutiny-esque work is an audit related service and, they would have said, didn’t fall for consideration as ‘internal audit services’.  Many of these firms will have been very close to the wire in doing this historically as they blurred the line between internal audit and external audit focus. 

Having said this, there may still be components of the overall internal scrutiny function that an audit committee, or equivalent, may look to feed in from the audit work in obtaining their own required levels of assurance.  This is more difficult to justify nowadays, however, because of the enhanced internal scrutiny requirements within the Handbook. 

Reporting on internal financial controls when required by law or regulation is included as an example of an ‘audit related service’ (ES5.36).  However, limited scope outsourcing of elements of the internal scrutiny function is only going to fall under this banner where additional work on internal controls is authorised by those charged with governance, and:

• is integrated with the work performed in the audit and performed largely by the existing audit team; and
• is performed on the same principal terms and conditions as the audit.

Many firms may consider it to be cleaner and less likely to give rise to confusion and gaps in understanding or perception if they draw the line more firmly in the sand.  Firms must remember that the trust’s compliance with the Handbook requirements are the important thing here, and that the external auditor should not be acting as an enabler for non-compliance.

Competitor firms are still pitching for both internal scrutiny and external scrutiny work, why shouldn’t I? 

Some firms, in many sectors, pitch for both pieces of work, with the intention of taking only one.  This sector has become conditioned to wanting the same firm to undertake both pieces of work, and therefore will require a period of realignment of understanding… though they don’t have long to get their heads around it. 

Firms that are pitching for internal scrutiny and external audit work with the intention of winning both should be taking a different approach.  It doesn’t make it OK to do something because the firm down the road is doing it.  There is no such thing as herd immunity when it comes to FRC Ethical Standard Compliance.

Should we get on the internal audit merry-go-round?

Some firms will have already acted to communicate with their clients and peers to set up reciprocal arrangements whereby they may have a formal or informal agreement for cross-referral of work. 

A number of firms have already set up and strengthened their internal audit provision capabilities to be able to offer genuine internal scrutiny services.  Others have decided that they are external audit specialists and that the risk to independence, alongside the internal audit dabbler risk means that it is not in the best interests of their firm, or the academy trusts to act in an internal scrutiny role.

This change, along with others made by Ethical Standard 2019, ought to emphasise that the first word on the external auditor’s report is independent.  In the context of the academies sector, the changes also serve as a useful reminder that the ESFA and DfE do not set the core requirements for auditors, and that auditors have extant frameworks in place to ensure independence and quality and to protect both the firms and the audited entity from factors that may ultimately negatively impact on the ability to give the level of independent scrutiny that the sector requires.

Where can I find out more?

We are running our usual programme of academies updates for accountants and auditors over the summer.

We have sessions from ESFA, as well as legal, internal scrutiny and other essential updates in our Academies Update Conference, now in its 10^th year, presented via Mercia Live on 18 June and 10 September.

Our Academies Audit and Accounts Update is also running via Mercia Live on 23 and 24 June, as well as there being in-house training options available.

If you need to know more about the changes made by the Ethical Standard 2019, you can also access a recording of our Revisions to Audit Standards: Ethical Standard 2019 webinar from our extensive online training library.