The FRC’s new Audit Enforcement Procedure: what audit committees and CFOs need to understand

Audit / Corporate Governance / Regulatory Compliance  |  7 min read  |  Raayzel Business Consulting

On 1 July 2026, the Financial Reporting Council implemented its revised Audit Enforcement Procedure. The changes are significant, and most of the commentary that has followed has focused on what they mean for audit firms. That focus is understandable but incomplete. The revised AEP has material implications for the companies being audited, and specifically for the audit committees, CFOs, and boards who manage the relationship between the company and its auditors, the relationship between the company and the FRC, and the governance of audit-related concerns when they arise.

This article examines what the revised AEP actually changes, why those changes matter for companies rather than just for audit firms, and what audit committees and CFOs need to build into their governance approach in response to a regulatory framework that has materially altered the incentives and obligations of the auditors they work with.

What the FRC changed and why

The FRC’s previous Audit Enforcement Procedure was widely criticised for producing lengthy, resource-intensive investigations that took years to resolve. High-profile audit failures that reached the public domain many years after the underlying conduct created a perception that enforcement was slow, unpredictable, and disproportionately burdensome relative to outcomes. Both audit firms and companies with connected enforcement proceedings faced prolonged uncertainty. The FRC itself acknowledged that the framework needed modernisation to be effective in maintaining confidence in audit and corporate reporting.

The revised AEP, published in draft in autumn 2025 and finalised on 17 June 2026 following a consultation to which 28 professional bodies, Big Four and mid-tier audit firms, and law firms responded, introduces three structural changes that together represent a significant philosophical shift in how the FRC approaches enforcement.

First, the revised AEP introduces three new pathways to resolution: Published Constructive Engagement, the Accelerated Procedure, and the Early Admissions Process. These pathways sit alongside the existing formal investigation route and are designed to allow the FRC to calibrate its response to the nature and severity of the conduct in question. Not every case will follow the same procedural track. The FRC now has the tools to respond proportionately, which means faster resolution in appropriate cases and more targeted use of formal investigation where the seriousness of the conduct warrants it.

Second, the revised AEP raises the threshold for commencing a full formal investigation. Cases that previously would have entered the formal investigation route by default may now be resolved through one of the new pathways, particularly where the auditor is prepared to engage constructively and early with the FRC’s concerns. This is intended to reduce the number of cases that consume significant enforcement resources without producing proportionate public benefit, and to free capacity for robust action in cases involving serious or significant failures.

Third, the revised AEP integrates the FRC’s supervisory, investigatory, and enforcement functions more closely. Initial enquiries are now conducted under the oversight of the Executive Director of Supervision before matters are referred for investigation, creating a more joined-up regulatory approach in which early-stage concerns can be identified and addressed before they develop into formal enforcement proceedings.

Why auditors will behave differently from 1 July 2026

The change that has the most immediate practical significance for audit committees and CFOs is the one that has received the least attention in post-AEP commentary: the new framework materially increases the incentives and pressures on auditors to engage with the FRC earlier and to make disclosures to the regulator at a stage where companies may not be expecting or prepared for that to happen.

The Early Admissions Process is the specific mechanism through which this plays out. Under the previous AEP, an auditor facing a potential enforcement case had limited incentive to approach the FRC proactively, because doing so did not provide a clear procedural advantage and the formal investigation process was the same regardless of whether the auditor had volunteered information or had the information obtained through the FRC’s supervisory or investigatory functions. The revised AEP changes that calculus.

Under the new framework, early engagement with the FRC, including voluntary disclosure of concerns or potential non-compliance, can lead to resolution through the Early Admissions Process or the Accelerated Procedure rather than a full formal investigation. This creates a genuine procedural incentive for auditors to surface concerns to the regulator earlier than they might previously have done. The FRC has been explicit that it wants auditors to engage proactively where concerns arise, and the revised AEP is designed to reward that engagement with faster and potentially more favourable resolution.

The practical consequence for companies is significant. Where an auditor becomes aware of a concern relating to fraud, misconduct, a going concern question, a material misstatement, or a significant audit quality issue, the new framework creates pressure to disclose that concern to the FRC at an earlier stage than the previous framework did. A company that has a live internal investigation, a regulatory matter in progress, or an unresolved audit qualification concern may find that its auditor is actively considering FRC disclosure at a point in the process when the company had not anticipated regulatory engagement.

As one law firm has noted in its analysis of the revised AEP, companies with active investigations must now factor into their investigation strategy the increased likelihood that auditors will seek to engage with the FRC at an earlier stage. Companies should also expect auditors to seek much fuller disclosures and ongoing updates on live internal or regulatory investigations, requiring careful handling to protect privileged work product.

The audit committee’s role in the new enforcement landscape

The audit committee’s relationship with the external auditor has always been one of the most consequential governance interfaces in listed companies. Under the revised AEP, that relationship carries additional weight because the audit committee is the primary governance mechanism through which the company exercises oversight of audit quality and manages concerns that arise in the audit process.

Audit committees that have treated the auditor relationship primarily as an administrative oversight function, reviewing audit plans, approving fees, and receiving annual quality reports, need to recalibrate that approach in light of what the revised AEP has changed. The audit committee now needs to understand not only what the auditor is doing but what pressures and incentives the auditor is operating under, and specifically what circumstances might lead the auditor to consider proactive engagement with the FRC.

This requires the audit committee to have a more active and specific conversation with the auditor about the revised AEP and its implications for how the relationship between the auditor and the regulator operates. Audit committees should specifically discuss with their auditors the circumstances under which the auditor would consider engaging with the FRC under the new pathways, what the auditor’s internal governance process is for making such decisions, and what notice, if any, the company would receive before the auditor engaged with the FRC about a company-related matter.

These are not questions that most audit committees have previously needed to ask explicitly. They are now essential elements of effective audit committee governance in the post-AEP environment.

Implications for companies with live investigations or audit concerns

The companies for whom the revised AEP is most immediately consequential are those that have, or may have, live internal investigations, unresolved audit concerns, or matters that could lead to audit qualification or restatement. For those companies, the change in auditor incentives created by the revised AEP is not an abstract governance concern. It is an immediate strategic consideration.

Several specific situations create elevated exposure in the new enforcement landscape.

• Companies with live internal investigations into financial reporting, fraud, or misconduct need to assess whether and when those investigations are likely to come to the attention of the auditor, and whether the auditor’s awareness of the investigation creates an obligation or incentive to engage with the FRC. The privileged status of investigation materials needs to be protected carefully, and the timing and content of disclosures to the auditor need to be managed with legal advice.
• Companies where the auditor has raised concerns about going concern, significant accounting judgments, or the adequacy of internal controls need to understand that the new pathways create a mechanism for the auditor to engage with the FRC about those concerns at an earlier stage than was previously likely. Unresolved concerns that persist across audit cycles are particularly exposed under the new framework.
• Companies that have received a qualified or modified audit opinion, or where the auditor has included an emphasis of matter or key audit matter relating to a significant unresolved issue, need to assess whether that matter creates audit enforcement risk under the revised AEP and to manage the auditor relationship accordingly.
• Companies undergoing significant transactions, restructuring, or other events that affect the audit scope or audit opinion need to ensure that the implications of those events for the auditor’s regulatory obligations under the revised AEP are factored into transaction and restructuring planning.

The self-reporting question

One of the most practically significant questions that the revised AEP raises for companies is whether and when voluntary self-reporting to the FRC is in the company’s interest. Under the previous framework, self-reporting by companies was relatively uncommon and the regulatory framework did not provide clear incentives for it. The revised AEP changes the context in which that question arises.

Where a company becomes aware of a matter that is likely to come to the FRC’s attention through the auditor or through the FRC’s supervisory activities, proactive engagement with the regulator may be in the company’s interest from a governance and reputational perspective, even if it does not provide a formal procedural advantage equivalent to the Early Admissions Process available to auditors. A company that engages constructively with the FRC before being the subject of a formal enquiry is likely to be treated differently from one that is first engaged with in a formal enforcement context.

The decision about whether and when to self-report is a legal and governance judgment that requires specialist advice in the specific circumstances of each case. What the revised AEP makes clear is that this question will arise more frequently, and often earlier in the lifecycle of an issue, than was the case under the previous framework. Boards and audit committees need to have a considered position on how they would approach this question before it becomes urgent.

The connection to Provision 29 and internal controls governance

The revised AEP does not operate in isolation from the other significant regulatory developments affecting UK listed companies in 2026. Its connection to Provision 29 of the UK Corporate Governance Code is particularly important.

Provision 29 requires boards to monitor and review the effectiveness of material controls and to make a declaration in the annual report on that effectiveness. The material controls framework includes financial reporting controls, which is the domain that the FRC’s enforcement activity most directly addresses. A company that is producing its first Provision 29 declaration in early 2027 is simultaneously operating in an enforcement environment where the FRC’s auditor has stronger incentives than ever before to surface concerns about those same financial reporting controls to the regulator.

The governance implication is direct. A board that produces a Provision 29 effectiveness declaration while the auditor has unresolved concerns about the adequacy of the controls being declared effective is in a significantly exposed position. The revised AEP increases the likelihood that those unresolved concerns reach the FRC before the board has had the opportunity to address them. The best protection against that outcome is not managing the auditor relationship more carefully. It is ensuring that the internal controls framework is genuinely adequate and that the evidence base supporting the Provision 29 declaration is robust enough to withstand the scrutiny that follows if the auditor does engage with the FRC.

This reinforces the argument that Provision 29 compliance needs to be a substantive governance priority rather than a reporting exercise. The revised AEP has made the cost of inadequate internal controls governance materially higher than it was before 1 July 2026.

What audit committees and CFOs should do now

The governance response to the revised AEP needs to operate across several dimensions simultaneously. The following are the priorities that audit committees and CFOs should address in the months following the AEP’s implementation.

• Auditor relationship conversation: audit committees should initiate a specific conversation with their external auditors about the revised AEP, covering the three new pathways, the circumstances under which the auditor would consider using them, the auditor’s internal governance process for FRC engagement decisions, and the notice the company would receive before any such engagement. This conversation should be documented and should form part of the audit committee’s record of its oversight of the auditor relationship.
• Live concern assessment: companies should conduct an assessment of any matters currently in the audit relationship that could be characterised as unresolved concerns, qualified opinions, emphasis of matter issues, or significant audit judgments. For each such matter, the question of whether it creates audit enforcement risk under the revised AEP should be considered with legal advice.
• Investigation protocol review: companies that have or might have internal investigations should review their investigation protocols in light of the revised AEP. The timing and content of disclosures to auditors, the protection of privileged materials, and the circumstances under which the company would consider voluntary engagement with the FRC all need to be addressed explicitly in the protocol.
• Provision 29 integration: the board’s Provision 29 compliance programme should specifically address the connection to audit enforcement risk. Where the material controls assessment identifies weaknesses or gaps, those need to be remediated before the annual report declaration rather than disclosed through the declaration with the expectation that the auditor will not separately engage with the FRC about the same matters.
• Board-level awareness: the board, and not only the audit committee, needs to understand the revised AEP and its implications for governance risk. The FRC’s enforcement activity is increasingly a board-level governance concern rather than a matter that can be managed entirely at the audit committee level, particularly where enforcement risk connects to the accuracy of public reporting and board attestations.

The governance question the revised AEP is really asking

The FRC’s stated objective in revising the AEP is to enable earlier engagement, more proportionate responses, and faster resolution of audit enforcement cases while maintaining the rigour and quality that supports public confidence in audit and corporate reporting. Those are laudable objectives and the revised framework is a genuine improvement over the previous one from a regulatory efficiency perspective.

For companies, the governance question the revised AEP is really asking is whether the organisation’s relationship with its auditors is genuinely transparent and whether the audit quality and internal controls governance the company maintains is robust enough to withstand an enforcement environment in which concerns reach the regulator earlier and are resolved more quickly than was previously the case.

Organisations that have maintained audit relationships characterised by genuine transparency, resolved audit concerns promptly, and built internal controls frameworks that support accurate financial reporting are well positioned in the new enforcement landscape. Organisations where audit concerns linger unresolved, where the auditor relationship is managed primarily to avoid difficult conversations, or where internal controls governance has been treated as a compliance obligation rather than a substantive governance priority, are considerably more exposed than they were before 1 July 2026.

The revised AEP is ultimately a signal that the FRC intends to be a more active and responsive regulator. For audit committees and CFOs who take governance seriously, that signal should be welcome. For those who have relied on the slowness and complexity of the previous enforcement framework as a de facto protection against regulatory scrutiny, the new framework represents a material change in the risk environment they are operating in.

Raayzel works with audit committees, CFOs, and boards to assess internal controls governance, strengthen the evidence base for Provision 29 compliance, and design audit committee governance frameworks that are adequate for the current regulatory environment. The work is advisory and execution-oriented, calibrated to the specific governance architecture and regulatory profile of each organisation.

Stay ahead of the UK audit, governance, and regulatory compliance agenda.

Sign up for free insights and resources from Raayzel Business Consulting: https://lp.constantcontactpages.com/sl/sBV4psC/insights

Book a free 30-minute consultation with us at Raayzel: https://calendly.com/raayzelconsulting/30min