As part of the wider shake-up of corporate governance and audit reform, two measures that interact with each other and have the potential to drive improvements in corporate reporting and audit quality are the UK government’s proposals for companies to write a Resilience Statement and to publish a triennial Audit and Assurance Policy (AAP). ICAEW is urging companies to get ahead of the new requirements and for audit committees and auditors to engage now with the steps required. This article outlines where we are, how we got here and what the profession is doing to progress the proposals.

On 31 May 2022, the UK government unveiled its plans for corporate reporting and audit, following the 2021 consultation on its White Paper on Restoring Trust in Audit and Corporate Governance.

Initial reactions to that Feedback Statement were somewhat muted, with disappointment expressed at the lack of progress towards a more robust internal controls regime in the UK. There is a high degree of uncertainty around which measures will be progressed and a vague timeline. However, the profession is focused on progressing those proposals that can be kicked off without legislation or new regulation, while continuing to put pressure on further reform.

A policy for progress

In 2021, ICAEW’s Audit and Assurance Faculty published Developing a Meaningful Audit and Assurance Policy, which is helping to inform the debate. An updated version is set to be published shortly. In the first edition of our report, we examined the challenges companies may have to overcome when creating an AAP and made nine recommendations to help a policy meet its full potential. We urged companies to get ahead of the new requirements and encouraged audit committees and auditors to engage with the steps required in preparing for the AAP. Following the government’s Feedback Statement, this rings true more than ever, and some companies are already producing AAPs.

Public Interest Entities (PIEs) will be required to publish their AAP every three years – and more companies may find they are in this category. Forthcoming legislation is expected to classify companies with more than 750 staff and an annual turnover of more than £750m as PIEs. These companies will also need to publish annual implementation reports on how their assurance procedures work in practice.

A recent ICAEW Insights article considers some fundamental steps for getting the AAP right. In this, Jayne Kerr, PwC Director, Audit Public Policy, notes the importance of mindset. “The AAP is more than a compliance exercise. It is a really important way for directors to take a fresh look at the type of financial and non-financial information they’re issuing, how they reach a comfort level with it and how internal and external stakeholders can rely upon it,” she says.

Government proposals

Possible AAP requirements set out by the government include:

• setting out whether and how the company has sought independent assurance on all or part of the Resilience Statement, or over its internal controls framework;
• describing the internal auditing and assurance process;
• describing the company’s policy in relation to the tendering of external audit services;
• stating whether any independent assurance proposed within it will be ‘limited’ or ‘reasonable’ assurance, or whether an alternative form of engagement or review will be undertaken;
• stating whether any independent assurance beyond the statutory audit will be carried out according to a recognised professional standard; and
• more generally, focusing on how companies are ensuring the integrity of their annual statutory and voluntary disclosures beyond the financial statements, demonstrating that these disclosures are underpinned by robust and reliable internal processes.

Guidance on the AAP is expected to come from the Financial Reporting Council. The government noted in its Feedback Statement that for PIEs that are required to produce an audit committee report, the AAP itself and the annual implementation report on the AAP should be published within the same section of the annual report as the audit committee report.

For other companies that are PIEs by virtue of the new size threshold, which will not be required to have an audit committee, it has not yet been decided whether the AAP should be in the strategic report or somewhere else in the annual report.

Closing expectation gaps

As ICAEW’s AAP publication notes: “The expectation gap between the confidence and assurance that the statutory audit currently delivers, and the understanding of shareholders and other users as to what is assured has been at the heart of a number of recent reports, including the Brydon Report.” The AAP might offer the profession the opportunity to dispel some misunderstandings if used to its full potential. The AAP “offers the means to describe the role the external auditor plays, both through the statutory audit and other assurance activities”.

The AAP also has the potential to underpin progress in audit committees’ and investors’ understanding of limited and reasonable assurance and encourage them to focus on the need for assurance in areas such as cyber security and environmental, social and governance reporting. Importantly, the government sees the AAP as a vehicle for setting out which parts of the Resilience Statement have been subject to assurance.

Risk and resilience issues

The new Resilience Statement will subsume the existing Going Concern and Viability Statements. The statement needs to include how the company is addressing risks or resilience issues, including threats to business continuity, supply chain and cyber security.

The new legislation will include the requirement for at least one reverse stress test – according to the nature, size and complexity of each business – to be chosen by the company and outlined within the statement. ICAEW issued guidance on reverse stress testing for entities and auditors with the pandemic in mind, but the information it contains remains relevant, for entities and auditors.

A recent ICAEW Insights article considers the government proposals to introduce a Resilience Statement for PIEs, and shares some of the profession’s responses to this. “The Resilience Statement is certainly providing a framework that should provide investors with greater insight and information,” says Mark Kennedy, Partner, Audit and Assurance, Mazars. “In doing so, it will drive a greater focus among boards and auditors on a more holistic expression of the position of a particular company.”

It has been widely acknowledged that disclosures under the Viability Statement often lacked specificity and sufficient detail to assure investors and other stakeholders that a company could deal with any potential business shocks.

In its 2021 response to BEIS, ICAEW said: “To effect real change, it is important that the proposals for a Resilience Statement do not simply result in a different type of boilerplate reporting. To ensure meaningful improvements to the quality of reporting, the Audit, Reporting and Governance Authority (ARGA) must emphasise directors’ accountability for the quality of this statement and ensure it is not seen simply as an extended Viability Statement.”

The jury is still out on whether the Resilience Statement will restore trust among investors. As Kennedy observes: “The quality of reporting derives not just from the framework, but also on the extent to which professional reporters really engage with the unique nature of a company.”

To this end, the proposals for the Resilience Statement are designed with some degree of flexibility and tailoring to the entity in mind. Instead of mandating a common set of risks, companies may be expected to “report on matters that they consider a material challenge to resilience over the short and medium term, together with an explanation of how they have arrived at this judgement of materiality”.

Kennedy goes on to say: “It is unavoidably forward-looking – it is in essence forecasting, which ‘usually tells us more of the forecaster than the forecast’, as Warren Buffet famously said.”

Clarity and balance

It is expected that the government will publish a draft bill on the proposed reforms late in 2022. Once the detail is clearer, it is hoped that new legislation will be published in 2023, giving enough time for all stakeholders to get to grips with the new regime.

As this agenda moves forward, ICAEW and others within the profession will need to take a keen interest and apply pressure to ensure that what comes through is not asymmetrical, focusing unduly on auditors, for example, rather than other areas of the corporate reporting ecosystem.

About the authors
Alex Russell, Head of Audit and Assurance Strategy, ICAEW, and Amy-Joy Butler, Technical Manager, Audit and Assurance, ICAEW