Risk Reporting Protocol
1 minute read
The FRC’s designation as the Competent Authority for statutory audit in the UK requires us to monitor risks arising from the systemic and performance issues which have the potential to lead to the demise of a firm, the disruption of audit services, further audit performance issues and/or an impact on a firm’s financial stability.
We have an agreed protocol with the largest 12 firms, which are required to notify their Supervisor without undue delay of incidents which occur either in the UK or across the firm’s global network which could reasonably be considered to pose a significant financial, operational or reputational threat to the UK firm.
Examples of incidents to be reported under the Protocol
Report any incident that could materially affect the UK firm’s operations, reputation, or financial position, including:
- Reputational Impact: Events likely to damage the firm’s reputation nationally or internationally or attract adverse media coverage.
- Crisis Management: Events triggering the firm’s crisis management plan at local, UK, or global level.
- Financial Exposure: Claims or potential claims with significant financial risk or anticipated breaches of Professional Indemnity Insurance limits.
- Cybersecurity & Data Breach: Cyber-attacks impairing IT systems or causing data loss; breaches involving personal, confidential, or sensitive data.
- Leadership & Governance Issues: Serious complaints or allegations involving Senior Leadership Team, Board members, or partners that may lead to disciplinary action or adverse media comment.
- Staff Conduct: Complaints or allegations raising serious concerns about professional or ethical behaviour or weaknesses in detection systems.
- Audit Report Reliability: Situations where an audit report on a PIE, large AIM-listed entity, or Lloyd’s Syndicate may need withdrawal or cannot be relied upon.
- Regulatory Action: Any action by the firm’s Recognised Supervisory Body that could significantly impact firm operations or service lines.
- Other Material Events: Any matter likely to attract media attention with adverse reputational implications.
Information to include when reporting
Where issues require internal investigation, inform us at the outset and provide updates at agreed intervals, and include the following:
- Timings around the incident including when the firm’s risk team were first made aware, investigations commenced and the expected timeframe for any internal/external review.
- Where relevant, details of any failings in systems or controls relating to the incident and what has been done to ensure that the matter is limited to what has been reported and is not more widespread.
- Authorities involved.
- Impact on the UK firm. An assessment of the reputational impact across the group.
- Entities and clients involved.
- Advice received and any anticipated sanction timeline.
- Next steps.