The Auditor’s Responsibility to Report to the FRC
3 minute read
Auditors play an important role in supporting confidence in corporate reporting, audit quality and the effective operation of UK capital markets.
In certain circumstances, auditors of Public Interest Entities (PIEs) and other regulated entities may have statutory duties to report matters to regulators, including the Financial Reporting Council (FRC).
This page explains:
Auditors' responsibilities to report matters to regulators
Auditors may have legal or regulatory obligations to report information to a regulator, referred to in the ISAs (UK) as an "appropriate authority outside the entity".
These obligations may apply:
- Across all sectors, for example in connection with money laundering, terrorist financing or proceeds of crime legislation, or
- Because the audited entity operates in a regulated sector that has specific auditor-reporting requirements.
Examples of regulators to which auditors may have reporting obligations include:
- Prudential Regulation Authority (PRA)
- Financial Conduct Authority (FCA)
- Charity Commission
- The Pensions Regulator
- Other UK regulators with statutory auditor-reporting regimes
It is the auditor's responsibility to understand the reporting obligations that apply to the engagement. Determination of whether a matter is reportable will depend on the relevant legal and regulatory requirements.
Examples of reportable matters may include:
- Are of material significance to a regulator
- Affect an entity's compliance with legal or regulatory requirements
- Affect an entity's ability to continue regulated activities
- Indicate significant governance, control or conduct concerns, or
- Are relevant to a regulator's supervisory or enforcement responsibilities.
ISA (UK) 270
ISA (UK) 270 Special Considerations for Audits of Public Interest Entities—Communicating and Reporting to an Appropriate Authority Outside the Entity, sets out the auditor's responsibilities to consider whether information identified during the audit should be reported to an authority outside the entity.
The standard applies where law, regulation, or relevant ethical requirements:
- Require the auditor of a Public Interest Entity to report to an appropriate authority outside the entity, or
- Establish responsibilities under which reporting may be appropriate in the circumstances.
These requirements recognise that auditors may become aware of information that is relevant to a regulator's functions and objectives.
Auditors must consider these responsibilities throughout the audit engagement. Compliance with reporting obligations requires the exercise of professional judgement, taking account of the relevant legal, regulatory and ethical requirements.
Effective engagement between auditors and regulators is an important part of the UK's wider regulatory framework and supports the protection of investors, consumers and the public interest.
While ISA (UK) 270 addresses communications and reporting to an appropriate authority outside the entity in relation to Public Interest Entities, other ISAs (UK) also require the auditor to determine whether laws, regulations or relevant ethical requirements give rise to a responsibility to report matters to an appropriate authority outside the entity. These include ISA (UK) 240 (Revised March 2026), ISA (UK) 250 (Revised September 2026), and ISA (UK) 570 (Revised March 2026).
Reporting matters to the FRC
Under ISA (UK) 270, auditors are required to report information relating to a Public Interest Entity (or an undertaking with close links to that Public Interest Entity) where it concerns:
- A material breach of laws, regulations or administrative provisions governing the authorisation or activities of the Public Interest Entity
- A material threat to, or doubt about, the continued functioning of the Public Interest Entity, or
- A refusal to issue an audit opinion, or the issuance of an adverse or qualified audit opinion.
When should auditors contact the FRC?
Auditors should contact the FRC as soon as reasonably practicable after identifying a reportable matter.
Auditors do not need to wait for:
- Completion of the audit
- Confirmation of all relevant facts, or
- Completion of any internal investigation.
Early engagement can help the FRC assess emerging risks and determine whether regulatory action is necessary.
Should auditors also report to other regulators?
Auditors should consider all applicable legal, regulatory and professional obligations when deciding whether a report should be made.
Making a report to another regulator does not necessarily remove the need to consider whether the matter should also be reported to the FRC. Similarly, reporting a matter to the FRC does not remove any obligation to report the matter to another regulator.
The FRC works closely with other regulators where appropriate and recognises their statutory responsibilities for regulated entities.
How to report a matter to the FRC
If an auditor identifies a matter that should be reported to the FRC, they should email:
The report should include:
- The name of the entity
- A description of the matter being reported
- The relevant accounting or reporting period (where applicable)
- Any supporting information or documentation, and
- Contact details for any follow-up enquiries.
How the FRC handles information that it receives
When the FRC receives information from an auditor, it will assess the information to determine whether it is relevant to the FRC's statutory functions and whether any further action may be required.
The FRC may:
- Record and monitor the information received.
- Request further information or clarification from the auditor.
- Consider whether the information indicates wider risks to audit quality, corporate reporting or the public interest.
- Share information with other regulators or public authorities where permitted or required by law.
- Consider whether the matter falls within any of the FRC's supervisory, enforcement or regulatory responsibilities.
The FRC may not be able to provide detailed updates on any action taken in response to a report. However, reports received from auditors form an important part of the information available to the FRC in carrying out its regulatory functions.
Information provided to the FRC will be handled in accordance with applicable legal requirements, including relevant confidentiality, data protection and information-sharing obligations.