Audit enforcement reform – welcome progress, but not yet a full reset

In the UK, audit enforcement is governed by the Financial Reporting Council (FRC) under their Audit Enforcement Procedure (AEP). The FRC’s figures show that, since April 2023, it has opened 17 AEP investigations and 31 constructive engagement matters. The number of cases may be relatively small, but their influence is much wider. Enforcement shapes behaviour across the market. It affects how firms assess risk, how audit partners approach judgement, and how attractive the public interest entity audit market is to current and future participants.

Audit enforcement matters. It is one of the ways in which confidence in audit is maintained, lessons are learned and high standards are upheld. A well-balanced enforcement regime must be capable of acting firmly where there have been serious failures, but must also be fair, proportionate and predictable.

Last month, the FRC announced an update to the AEP, which became effective from the 1 July 2026. The changes follow a consultation that attracted substantial engagement from audit firms, professional bodies, investor representatives and other stakeholders and is an important moment for the audit market.

So, what are the key changes?

A key element of the updated framework is the introduction of new enforcement options. Under the old system, the FRC only had the option to choose between a ‘private constructive engagement’, which is an informal improvement-focused remediation process with audit firms, or launching a full investigation. At a high level, the new rules extend the existing framework to include three new routes with the overall aim being to improve the speed of investigations and outcomes, and the proportionality of responses. The particular route chosen will be determined by a revised public interest test.

Route to resolution	Summary	Sanctions possible?	New?
Constructive Engagement (CE)	A confidential supervisory process intended to address less serious deficiencies through remediation rather than formal enforcement. Outcomes are used to publish themes and learnings for the benefit of audit firms and other stakeholders.	No	No
Published Constructive Engagement (PCE)	Cases are similar in severity to the CE but under this route the FRC determines that individual outcome should be published as an active record on the FRC website to enhance transparency with the public. The announcement won’t name the audited entity or the individual auditor, but it will identify the audit firm and summarise the issue that is subject to the PCE.	No	Yes
Enforcement investigation (EI)	For more serious cases the FRC will perform a full enforcement investigation, often involving lengthy evidence gathering, settlement discussions or contested proceedings before a Tribunal.	Yes	No
Accelerated Procedure (AP)	At commencement of an enforcement case where the relevant facts are already established, or where further investigation would add limited value, the FRC can now move directly to a disciplinary outcome without undertaking every stage of a conventional investigation. The intention is not to reduce scrutiny but to avoid unnecessary procedural delay where the evidential position is already sufficiently clear. This should allow sanctions to be imposed significantly earlier while reducing costs for both the regulator and those under investigation.	Yes	Yes
Early Admissions Process (EAP)	Where firms or individuals acknowledge misconduct at an early stage, the revised procedure provides a structured route to resolving matters more quickly, recognising cooperation while preserving appropriate regulatory oversight. Respondents must notify their interest in participating in the EAP within 28 days of receipt of the Notice of investigation.	Yes – although discounts are much greater under this process to encourage earlier engagement with the regulator.	Yes

The CPIA welcomes the direction of travel in the revised AEP. The FRC has recognised that a more graduated set of responses is needed, rather than a process that can appear to move from supervisory concern to full enforcement investigation with few interim steps. The introduction of new resolution routes provides the regulator with more tools to match its response to the facts of a case, allowing for a more proportionate response. Other changes, such as the implementation of a Senior Designated Officer – who has access to the relevant resources and knowledge to oversee cases and, in response to consultation feedback, the ability to make decisions regarding route or referral of cases – is a positive development that could improve the consistency and transparency of information available to stakeholders.

These changes matter because good regulation is not simply about sanctioning wrongdoing, it is about improving outcomes. In audit, those outcomes include better quality work, stronger systems within firms, more effective challenge of management, and a market capable of attracting talented professionals. Many of the respondents who provided consultation feedback, including the CPIA, noted that a process that is seen as excessively punitive or uncertain risks encouraging defensive practice. That is not in the interests of investors, audited entities, audit firms or the wider economy.

Are there still gaps?

While the reforms are broadly pragmatic, several questions remain.

• While the FRC has recognised that PCE cases should carry the presumption that a standalone announcement at commencement is not required, the same cannot be said for the three sanctions routes despite feedback from many respondents, including the CPIA, throughout the consultation process. Here, the FRC has chosen largely to maintain its existing approach of issuing an announcement to the market at the commencement of an enforcement case. In its communications around the updated AEP, the FRC has recognised the potential prejudice to firms and individuals this may cause, but it says it views such announcements as important in maintaining public confidence, protecting users of financial statements and preventing speculation. That is a defensible regulatory position in some cases: where a matter is already in the public domain, or where there is a clear investor protection concern, silence may not be realistic. But the CPIA continues to believe that commencement announcements should be exceptional rather than routine. Public confidence is not strengthened if the process is perceived as punishment by announcement.
• The revised public interest test is also a step forward, but there remains scope for greater clarity. The CPIA argued that ‘public interest’ should not be treated as synonymous with the fact that an audit relates to a public interest entity (PIE), as this can mean that mean that too wide a net is cast, and that a minor deficiency on a PIE audit should not automatically become an enforcement matter as this would not be proportionate. The FRC is right to publish supporting guidance on case assessment and public interest factors, but the most important test will be how that guidance is applied in practice. The market needs to see that issues without significant harm, repeated behaviour, integrity concerns or wider stakeholder impact can be resolved through proportionate supervision and remediation.
• More clarity around the FRC’s approach to determining the enforcement route for specific cases would help firms and individuals alike. Cases should ordinarily start in the supervisory space, moving to investigation only where aggravating factors make that necessary. That would not weaken enforcement; it would strengthen it by reserving the most serious tools for the most serious cases. It would also make the system more predictable, allowing firms and audit partners to understand why one route has been selected over another.
• The FRC has also decided not to change its position materially on individual auditor accountability. Individual accountability is plainly necessary where there is evidence of personal culpability, recklessness, integrity concerns or a failure to discharge clear responsibilities. But the audit model has evolved. ISQM 1 places greater emphasis on firm-wide systems of quality management. Audit quality is produced by teams, methodologies, quality controls, specialists and firm culture, not only by the signing partner. A modern enforcement regime should reflect that reality by starting from firm accountability and bringing individuals into scope only where there is a clear basis for doing so. This is not about shielding individuals from responsibility, but aligning accountability with how audits are actually delivered. It is also about talent. If senior auditors believe they may be publicly associated with enforcement processes even where the primary issue lies in firm systems or complex judgement, some will be less willing to take on challenging audits. That would be a poor outcome for the public interest.

Looking ahead

The revised AEP reflects a broader evolution in regulatory thinking.

Rather than viewing enforcement solely as a punitive function, regulators increasingly seek to intervene earlier, encourage remediation and disseminate lessons across the market before problems become systemic. It would be helpful for the FRC to publish data on how the revised routes are being used, case duration, costs, publication decisions, outcomes and lessons learned. The FRC should also keep the AEP closely aligned with its wider supervision strategy. Together, supervision and enforcement should create a framework that is trusted, proportionate and focused on raising audit quality.

The CPIA and others have also suggested a form of ‘safe space’ or regulatory sandbox for auditors to discuss high-risk clients and difficult issues with the regulator as a means to support confidence of an audit firm in high-risk engagements and improve the confidence of the regulator in the high-risk audits. Such a mechanism could support earlier intervention, better audit quality and less defensive behaviour, and ultimately reduce the likelihood of proceedings needing to reach enforcement stage.

More broadly, the changes reinforce the FRC’s ambition to become a more agile regulator. The introduction of graduated enforcement tools allows the regulator to tailor its response more closely to the seriousness of the conduct while maintaining public confidence through greater transparency.

Whether these ambitions are realised will depend less on the wording of the revised procedure than on how consistently it is applied in practice. If the FRC succeeds in shortening investigations, publishing meaningful lessons earlier and reserving lengthy investigations for genuinely contested or complex cases, the reforms are likely to be regarded as a significant step forward.

If, however, investigations remain lengthy or uncertainty develops around the choice of enforcement route, the procedural changes may prove less transformative than intended. For now, the revised Audit Enforcement Procedure represents an important evolution rather than a revolution. It equips the FRC with a broader enforcement toolkit, one that is intended to deliver faster accountability, greater flexibility and earlier market learning. In an environment where confidence in audit depends not only on high standards but also on effective regulation, that is a notable shift in itself.