SUP 3 Auditors

For the avoidance of doubt, this chapter does not apply to the following firms if they do not hold client money or client assets and do not appoint an auditor under or as a result of a statutory provision other than in the Act:

1. (1)

   authorised professional firms;

2. (2)

   energy market participants, including oil market participants to whom IPRU(INV) 3 does not apply;

3. (3)

   exempt insurance intermediaries;

4. (4)

   insurance intermediaries not subject to SUP 3.1.2 R(10);

5. (5)

   investment management firms;

6. (6)

   home finance administrators;

7. (7)

   home finance intermediaries;

8. (8)

   home finance providers;

9. (9)

   personal investment firms, including small personal investment firms;

10. (10)

    securities and futures firms; and

11. (11)

    service companies.

If a firm falls within more than one row in column (1) of the table in SUP 3.1.2 R, SUP 3.1.1 R requires the firm and its external auditor to comply with all the sections referred to in column (2) or (3).

The application of SUP 3.10 to the auditor of a lead regulated firm is qualified in SUP 3.10.3 R.

A firm which is mentioned in SUP 3.1.10 G should see the Prudential Standards part of the Handbook for further provisions on auditors as set out in SUP 3.1.10 G.

This chapter sets out rules and guidance on the role auditors play in the appropriate regulator's monitoring of firms' compliance with the requirements and standards under the regulatory system. In determining whether a firm satisfies the threshold conditions, the appropriate regulator has regard to whether the firm has appointed auditors with sufficient experience in the areas of business to be conducted by the firm. Auditors act as a source of information for the appropriate regulator in its supervision. They report, where required, on the financial resources of the firm, the accuracy of its reports to the appropriate regulator and its compliance with particular rules, such as the Client asset rules.

The Act, together with other legislation such as the Companies Acts 1985, 1989 and 2006, the Building Societies Act 1986 and the Friendly Societies Act 1992, provides the statutory framework for firms' and auditors' obligations.

It is the responsibility of an insurance intermediary's senior management to determine, on a continuing basis, whether the insurance intermediary is an exempt insurance intermediary and to appoint an auditor if management determines the firm is no longer exempt. SUP 3.7 (amplified by SUP 15) sets out what a firm should consider when deciding whether it should notify the FCA of matters raised by its auditor.

The rights and duties of auditors are set out in SUP 3.8 (Rights and duties of all auditors) and SUP 3.10 (Duties of auditors: notification and report on client assets). SUP 3.8.10 G includes the auditor's statutory duty to report certain matters to the FCA imposed by regulations made by the Treasury under sections 342(5) and 343(5) of the Act (information given by auditor or actuary to a regulator). An auditor should bear these rights and duties in mind when carrying out client asset report work, including whether anything should be notified to the FCA immediately.

This section requires a firm to appoint an auditor and supply the appropriate regulator with information about its auditor. The appropriate regulator requires such information to ensure that the firm has an auditor.

SUP 3.3.2 R applies to every firm to which this section applies. That includes a firm which is under an obligation to appoint an auditor under an enactment other than the Act, such as the Companies Act 1985 or the Companies Act 2006, as appropriate. Such a firm is expected to wish to have a single auditor who is appointed to fulfil both obligations. SUP 3.3.2 R is made under section 137A of the Act (The FCA's general rules), in relation to such firms, and under section 340(1) (Appointment) in relation to other firms.

SUP 3.3.7 R allows but does not require the appropriate regulator to appoint an auditor if the firm has failed to do so within the 28 day period. When it considers whether to use this power, the appropriate regulator will take into account the likely delay until the firm can make an appointment and the urgency of any pending duties of the appointed auditor.

The appropriate regulator is concerned to ensure that the auditor of a firm has the necessary skill and experience to audit the business of the firm to which he has been appointed. This section sets out the appropriate regulator's rules and guidance aimed at achieving this.

An auditor which a firm proposes to appoint should have skills, resources and experience commensurate with the nature, scale and complexity of the firm's business and the requirements and standards under the regulatory system to which it is subject. A firm should have regard to whether its proposed auditor has expertise in the relevant requirements and standards (which may involve access to UK expertise) and possesses or has access to appropriate specialist skill, for example actuarial expertise in carrying out audits of insurance companies or friendly societies where appropriate. The firm should seek confirmation of this from the auditor concerned as appropriate.

If it appears to the appropriate regulator that an auditor of a firm has failed to comply with a duty imposed on him under the Act, it may have the power to and may disqualify him under section 345 or 345A, respectively, of the Act. A list of persons who are disqualified may be found on the FCA's website (www.fca.org.uk).

To enable it to assess the ability of an auditor to audit a firm, the appropriate regulator may seek information about the auditor's relevant experience and skill. The appropriate regulator will normally seek information by letter from an auditor who has not previously audited any firm. The firm should instruct the auditor to reply fully to the letter (and should not appoint an auditor who does not reply to the appropriate regulator). The appropriate regulator may also seek further information on a continuing basis from the auditor of a firm (see also the auditor's duty to cooperate under SUP 3.8.2 R).

If an auditor is to carry out his duties properly, he needs to be independent of the firm he is auditing, so that he is not subject to conflicts of interest. Many firms are also subject to requirements under the Companies Act 1989, or the Companies Act 2006, the Building Societies Act 1986 or the Friendly Societies Act 1992 on auditor's independence.

The appropriate regulator will regard an auditor as independent if his appointment or retention does not breach the ethical guidance in current issue from the auditor's recognised supervisory body on the appointment of an auditor in circumstances which could give rise to conflicts of interest.

In complying with SUP 3.6.1 R, a firm should give a right of access at all times to the firm's accounting and other records, in whatever form they are held, and documents relating to its business. A firm should allow its auditor to copy documents or other material on the premises of the firm and to remove copies or hold them elsewhere, or give him such copies on request.

Section 341 of the Act (Access to books etc.) provides that an auditor of a firm appointed under SUP 3.3.2 R:

1. (1)

   has a right of access at all times to the firm's books, accounts and vouchers; and

2. (2)

   is entitled to require from the firm's officers such information and explanations as he reasonably considers necessary for the performance of his duties as auditor.

Section 389A of the Companies Act 1985 where applicable, otherwise sections 499 and 500 of the Companies Act 2006, section 79 of the Building Societies Act 1986 and section 75 of the Friendly Societies Act 1992 give similar rights to auditors of companies, building societies and friendly societies respectively.

Section 413 (Protected items), under which no person may be required under the Act to produce, disclose or permit the inspection of protected items, is relevant to SUP 3.6.1 R and SUP 3.6.3 G.

In complying with SUP 3.6.1 R, a firm should take reasonable steps to ensure that each of its appointed representatives or, where applicable, tied agents gives the firm's auditor the same rights of access to the books, accounts and vouchers of the appointed representative or tied agent and entitlement to information and explanations from the appointed representative's or tied agent's officers as are given in respect of the firm by section 341 of the Act (see also SUP 12.5.5 R (3)).

In complying with SUP 3.6.1 R, a firm should take reasonable steps to ensure that each of its suppliers under a material outsourcing arrangement gives the firm's auditor the same rights of access to the books, accounts and vouchers of the firm held by the supplier, and entitlement to information and explanations from the supplier's officers as are given in respect of the firm by section 341 of the Act.

In complying with SUP 3.6.1 R, a firm should take reasonable steps to ensure that all its employees cooperate with its auditor in the discharge of his duties under this chapter.

Firms and their officers, managers and controllers are reminded that, under section 346 of the Act (Provision of false or misleading information to auditor or actuary), knowingly or recklessly giving false information to an auditor appointed under SUP 3.3.2 R constitutes an offence in certain circumstances, which could render them liable to prosecution. This applies even when an auditor is also appointed under an obligation in another enactment.

A firm should consider whether it should notify the FCA and the PRA (if it is a PRA-authorised firm) or the FCA (in all other cases) under Principle 11 if:

1. (1)

   the firm expects or knows its auditor will qualify his report on the audited annual financial statements or add an explanatory paragraph; or

2. (2)

   the firm receives a written communication from its auditor commenting on internal controls (see also SUP 15.3).

The auditor of a firm has various rights and duties to obtain information from the firm and both to enable and to require him to pass information to the appropriate regulator in specified circumstances. This section imposes or gives guidance on those rights and duties.

The appropriate regulator may ask the auditor to attend meetings and to supply it with information about the firm. In complying with SUP 3.8.2 R, the auditor should attend such meetings as the appropriate regulator requests and supply it with any information the appropriate regulator may reasonably request about the firm to enable the appropriate regulator to discharge its functions under the Act.

SUP 3.5.4 G explains that an auditor whose appointment does not breach the ethical guidance in current issue from the auditor's recognised supervisory body will be regarded as independent by the appropriate regulator.

SUP 3.6.1 R requires a firm to cooperate with its auditor. SUP 3.6.3 G refers to the rights to information which an auditor is granted by the Act. SUP 3.6.4 G refers to similar rights granted by the Companies Act 1985 or where applicable, the Companies Act 2006, the Building Societies Act 1986 and the Friendly Societies Act 1992.

Within the legal constraints that apply, the appropriate regulator may pass on to an auditor any information which it considers relevant to his function. An auditor is bound by the confidentiality provisions set out in Part XXIII of the Act (Public record, disclosure of information and cooperation) in respect of confidential information he receives from the appropriate regulator. An auditor may not pass on such confidential information without lawful authority, for example if an exception applies under the Financial Services and Markets Act 2000 (Disclosure of Confidential Information) Regulations 2001 (SI 2001/2188) or with the consent of the person from whom that information was received and (if different) to whom the information relates.

1. (1)

   Auditors are subject to regulations made by the Treasury under sections 342(5) and 343(5) of the Act (Information given by auditor or actuary to a regulator). Section 343 and the regulations also apply to an auditor of an authorised person in his capacity as an auditor of a person who has close links with the authorised person.

2. (2)

   These regulations oblige auditors to report certain matters to the appropriate regulator. Sections 342(3) and 343(3) of the Act provide that an auditor does not contravene any duty by giving information or expressing an opinion to the appropriate regulator, if he is acting in good faith and he reasonably believes that the information or opinion is relevant to any functions of the appropriate regulator. These provisions continue to have effect after the end of the auditor's term of appointment.

   In relation to Lloyd's, an effect of the insurance market direction set out at SUP 3.1.13 D is that sections 342(5) and 343(5) of the Act (Information given by an auditor or actuary to a regulator) apply also to auditors appointed to report on the insurance business of members.

SUP 3.10.4 R provides that an auditor must ensure that a client assets report is prepared in accordance with the terms of, as the case may be, a reasonable assurance engagement or a limited assurance engagement. However, the FCA also expects an auditor to have regard, where relevant, to material published by the Financial Reporting Council that deals specifically with the client assets report which the auditor is required to submit to the FCA. In the FCA's view, a client assets report that is prepared in accordance with that material is likely to comply with SUP 3.10.4 R and SUP 3.10.5 R where that report is prepared for a firm within the scope of the material in question.

The rights and duties of auditors are set out in SUP 3.8 (Rights and duties of all auditors) and SUP 3.10 (Duties of auditors: notification and report on client assets). SUP 3.8.10 G also refers to the auditor's statutory duty to report certain matters to the FCA imposed by regulations made by the Treasury under sections 342(5) and 343(5) of the Act (information given by auditor or actuary to a regulator). An auditor should bear these rights and duties in mind when carrying out client asset report work, including whether anything should be notified to the FCA immediately.

It is the responsibility of an insurance intermediary's senior management to determine, on a continuing basis, whether the firm is an exempt insurance intermediary for the purposes of this requirement and to appoint an auditor if management determines the firm is no longer exempt. SUP 3.7 (amplified by SUP 15) sets out what a firm should consider when deciding whether it should notify the FCA of matters raised by its auditor.

1. (1)

   The FCA expects that the list of breaches will include every breach of a rule in CASS insofar as that rule is within the scope of the client assets report and is identified in the course of the auditor’s review of the period covered by the report, whether identified by the auditor or disclosed to it by the firm, or by any third party.

2. (2)

   For the purpose of determining whether to qualify its opinion or express an adverse opinion, the FCA would expect an auditor to exercise its professional judgment as to the significance of a rule breach, as well as to its context, duration and incidence of repetition. The FCA would expect an auditor to consider the aggregate effect of any breaches when judging whether a firm had failed to comply with the requirements described in SUP 3.10.5 R (1) to (4).

The Financial Services and Markets Act 2000 (Service of Notices) Regulations 2001 (SI 2001/1420) contain provisions relating to the service of documents on the FCA. They do not apply to reports required by SUP 3.10 because of the specific provisions in SUP 3.10.12 R.

A firm should ensure that:

1. (1)

   it considers the draft client assets report provided to the firm by its auditor in accordance with SUP 3.10.8DR (1) in order to provide an explanation of:

   1. (a)

      the circumstances that gave rise to each of the breaches identified in the draft report; and

   2. (b)

      any remedial actions that it has undertaken or plans to undertake to correct those breaches; and

2. (2)

   the explanation provided in accordance with (1):

   1. (a)

      is submitted to its auditor in a timely fashion and in any event before the auditor is required to deliver a report to the FCA in accordance with SUP 3.10.7 R or to the firm in accordance with SUP 3.10.8A R as the case may be; and

   2. (b)

      is recorded in the relevant field in the draft report submitted to it by its auditor.

The FCA expects a firm to use the client assets report as a tool to evaluate the effectiveness of the systems that it has in place for the purpose of complying with requirements to which SUP 3.10.5 R refers. Accordingly, a firm should ensure that the report is integrated into its risk management framework and decision-making.

SUP 3.4.2 R provides that a firm must take reasonable steps to ensure that its auditor has the required skill, resources and experience to perform its functions. The FCA expects a firm to keep under review the adequacy of the skill, resources and experience of its auditor and should critically assess the content of the client assets report as part of that ongoing review.