Financial Reporting Council Annual Enforcement Review 2026

On Thursday 23 July 2026, the Financial Reporting Council (“FRC”) published its Annual Enforcement Review (“the Review”) for the year to 31 March 2026, following on from its Annual Review of Audit Quality published on 22 July 2026.

Headline points

• The Review refers to the introduction of new enforcement routes under the AEP following its End-to-End Enforcement Process Review, including the Accelerated Procedure and Early Admissions Process, intended to facilitate swifter investigations and resolutions from 1 July 2026.
• The Review contains discussion of themes relating to co-operation and information gathering including interviews, and preservation of production of data, at much greater length than in previous years
• The FRC confirms that it is now routinely obtaining and reviewing Microsoft Teams messages, WhatsApp messages and other non-email communications during investigations
• Recurring themes in concluded audit investigations continue to include lack of professional scepticism, compliance with ethical requirements, fraud risk, revenue and revenue recognition, and insufficient audit evidence.
• The Review contains a warning regarding the use of artificial intelligence in audit and financial reporting. The FRC anticipates increased scrutiny of AI and emphasises that professional accountability remains with individuals.
• The number of new cases being opened is similar to last year and remains lower than in earlier years.  The conclusion of older cases has therefore resulted in a further reduction in the number of open investigations, from 32 down to 25.
• The average duration of constructive engagement was longer than in the previous year.

Co-operation and information gathering

Executive Counsel emphasises in her introductory comments that the FRC’s ability to progress investigations efficiently is dependent on cooperation from those under investigation, both in the production of relevant information and in “the adoption of an open and constructive approach throughout the investigation process”. She also notes that the success of the newly introduced Accelerated Procedure and Early Admissions Process will be significantly affected by the willingness of respondents to engage fully openly and actively.

Among the points highlighted by the Review on co-operation and information, the following are of particular interest:

• The FRC’s expectation that firms and individuals under investigation should cooperate fully and promptly, and notes that exceptional cooperation may lead to reductions in financial sanctions.
• The Review states that the enforcement team seeks dialogue with audit firms to resolve any queries or technical issues relating to production requests, noting that “this can involve the use of both established forensic technology techniques and emerging technologies, such as AI”.
• Over the past year, the FRC obtained material across an increasing number of our cases from forms of electronic communications other than email.  In particular, Teams messages, WhatsApp messages, text messages and other informal communications are now routinely sought and reviewed during investigations. This is borne out in our experience in recent years.
• The Review stresses that the FRC makes targeted (rather than blanket) requests for communications, and often makes sequenced requests as this is results in speedier receipt of material and can in the FRC’s view “be more manageable for the firms to comply with.”
• The Review comments that one of the problems being encountered is that some firms do not routinely retain non-email electronic communications used for the audit. Last year’s report contained a similar statement reminding firms to preserve “all forms of electronic communications as part of their compliance with the requirements of ISA (UK) 230”. The Review criticises one firm for the deletion of potentially relevant emails after an investigation had commenced.
• The Review states that firms can assist by:
  •  ensuring that they have in force a set of comprehensive data retention policies covering all communication channels for the purposes of the audit (email, messaging, collaboration platforms and use of AI).
  • internal audit compliance checks with retention policies.
  • secure data archiving systems,
  • legal hold procedures upon awareness of a potential regulatory investigation,
  • documenting data loss incidents
• The FRC reports that it has encountered problems in relation to the provision of inaccurate or incomplete information by firms, including duplicated email counts, errors in technical processing or human review, the incorrect application of search logic and incomplete material and metadata. The Review emphasises the importance of committing sufficient resources and robust quality control procedures in data processing, review and production in response to FRC data requests, and refers to the impact of these issues on delay and costs.  The Review also stresses the importance of bringing any errors in production to the FRC’s attention as soon as they are identified.
• The Review encourages firms to assist the FRC with progressing limited privilege waivers where appropriate, and maintain and produce clear records of privilege decisions to support transparency.
• Reference made is to the use of interviews as a valuable evidence-gathering activity, and it is stated that an interview bundle is provided in advance, “in good time to ensure interviewees have a fair opportunity to prepare”.
• The KPMG/N Brown and PwC/Babcock matters are cited as examples where self-reviews, root cause analyses and proactive engagement materially assisted the FRC's investigations and resulted in sanction reductions.
• In other cases, failures to cooperate have resulted in aggravated sanctions. Failure to co-operate can result in separate disciplinary proceedings.

Case Assessment

The number of cases opened by the Case Assessment team was 44 in the year, a slight increase on the previous year's 40 matters. Referrals from other FRC teams, most commonly AQR, remained the largest source of new cases, although complaint-driven matters increased significantly.

The efficiency of the Case Assessment process improved materially. The KPI for referring matters to the Conduct Committee within six months was achieved in 82% of cases, compared with only 55% in the previous year. The average referral time reduced from over ten months to four months.

Of the matters concluded by Case Assessment, seven were referred for investigation, six were transferred to the Supervisor team to resolve through Constructive Engagement, and 28 resulted in no further action. These figures continue to illustrate the significance of the filtering role performed by Case Assessment and the Conduct Committee before matters progress into full investigation.

Constructive Engagement

During the year:

• 10 matters already in Constructive Engagement were carried forward into the year;
• 6 new matters entered the process.

Of those 16 matters:

• 11 matters were concluded; and
• 5 remained ongoing at year end.

The most common areas in which weaknesses were identified were quality control procedures (nine cases); journal entry testing (seven cases); and revenue recognition (four cases). The most common underlying causes were inadequate guidance, training and methodology, insufficient challenge of management and professional scepticism, and poor documentation. 

The Review places emphasis on remediation outcomes. Firms were required to implement and demonstrate improvements including enhanced methodologies, increased supervision, improved risk assessment processes, upgraded data analytics tools, strengthened training programmes and targeted monitoring exercises.

As in previous years, the data demonstrates that Constructive Engagement is not a rapid process. The average duration increased to 17 months, compared with 13 months in 2024/25.

New investigations opened

The number of new investigations opened was seven (one less than last year), and remains lower than the level several years ago. Of those seven investigations:

• Four were opened under the AEP
• One concerned the unauthorised issuance of auditor's reports and was opened under the Accountancy Scheme.
• Two were opened under the Accountancy Scheme against accountants in business.

Notably, for the second consecutive year, none of the new AEP investigations arose from referrals by the Audit Quality Review ("AQR") team. The FRC attributes this, at least in part, to the continued use of Constructive Engagement and other supervisory tools to address less serious concerns identified during inspections.

All of the AEP investigations opened during the year were publicly announced, which had not been the case in previous years. In our view the number of investigations is too small to draw any inference as to whether there has been any change of approach. 

Cases concluded in the year

A total of 14 cases were concluded during the year, compared with 11 in the previous year. Those concluded matters comprised:

• 11 resulting in sanctions (10 through settlement and one Tribunal determination); and
• 3 closed with no further action.

For the fifth consecutive year, concluded cases exceeded the number opened during the same period, resulting in a further reduction in the overall investigation portfolio. 

Ongoing cases at 31 March 2026

As at 31 March 2026, there were 25 open investigations, comprising 20 audit investigations and five relating to professional accountants working in business.

Sanctions

The FRC imposed financial sanctions against audit firms in six cases, totalling:

• £16.3 million before discounts; and
• £11.8 million after discounts.

Financial sanctions against audit partners totalled:

• £0.96 million before discounts; and
• £0.80 million after discounts and/or mitigation.

Settlement discounts ranged between 25% and 43%, reflecting the timing of admissions and mitigation, including cooperation.

Non-financial sanctions included:

• six exclusions from professional bodies;
• seven conditions or requirements;
• five undertakings;
• 18 Severe Reprimands; and
• 10 declarations.

The Review devotes space to contains discussion of two enforcement outcomes, being the Accountancy Scheme investigation against accountants in business at Carillion, and the unauthorised audit reports findings against BDO in relation to the Nightingale matter.    

In relation to the other concluded investigations, the Report identifies recurring themes including failures in relation to going concern, insufficient professional scepticism, inadequate challenge of management assumptions and failures to obtain sufficient appropriate audit evidence.

Timeliness

The FRC met its two-year KPI in 50% of the six cases that were subject to the two-year KPI expiring in the year to 31 March 2026. In one case the FRC attributed missing that KPI to various factors that included the availability of Counsel and internal resources, as well as needing to obtain further information from the Respondents at a late stage. 

The FRC exceeded its three-year KPI target in the ten cases subject to the three-year KPI expiring in the year by achieving 100% compliance against an 80% target.

The average period between commencement of an investigation and the earliest of the following: issue of a Proposed Formal Complaint, Investigation Report, settlement or closure, for the cases that reached that milestone in the year to 31 March 2026, reduced from 28 months to 21 months.

However, the average length of cases that were concluded by settlement during the year to 31 March 2026 increased from 45 months to 50 months, largely reflecting the conclusion of several particularly large and complex investigations, including BDO and Carillion.

Artificial intelligence

For the first time, the Review expressly identifies artificial intelligence as an area of anticipated regulatory focus. 

Executive Counsel refers to the rapidly changing landscape for audit and financial reporting and makes clear that the enforcement team will be extensively scrutinising the use of AI in financial reporting and audit. Whilst recognising the opportunities presented by AI, the FRC emphasises that professional accountability remains with individuals and that investigation subjects must be capable of identifying, explaining and justifying their use of AI. 

Clyde & Co comments

The Review’s discussion of information-gathering and co-operation will be of particular interest to firms, especially in relation to the comments made about preservation of electronic communications and the problems encountered in document processing and production.

Some readers may not agree entirely with the suggestion made in the Review that the FRC’s sequential, targeted requests for production are beneficial in helping firms manage the production process. In recent years this approach has become more challenging for IT data production managers because of the increasingly complex interaction of combined search parameters, requests for hit numbers on differing assumptions, email threading requirements, and sequential separate requests that require the isolation of  the “delta” material not previously produced. The FRC’s production requests for communications are considered to be unusually demanding in terms of data production resource and expertise, relative to document productions required in other contexts. Firms lacking internal experience and expertise in dealing with complex structured requests for electronic communications of this kind will therefore need to consider making use of external resources to assist them.  

Executive Counsel’s high-level comments about AI signal that the use of AI will receive greater attention in forthcoming investigations. This is no great surprise, but firms will need to be ready to meet those challenges through designing procedures, policies and documentation that equips them and their audit teams (and in particular their Ris) to address any questions that might arise in the context of an enforcement investigation.