Have early and ongoing conversations with auditors and clearly document evidence for….
• application of new accounting standards
• accounting policies, particularly those that are new or changed
• judgements and estimates
• approach to journals
• valuations
• changes in activity including any joint arrangements
• risk sharing agreements
• agreement of balances disputes
• any other large, novel or complex transactions.
Briefing / The external audit: best practice in working well together
The annual external audit is not only a key statutory requirement for NHS organisations, but also provides important and valuable insights into the financial governance of the organisation. The audit process itself can be a challenging one for all involved with tight timelines and complex issues to resolve.
This briefing summarises the current audit context and shares top tips to plan for an audit that runs as smoothly as possible.
Introduction
The annual external audit is not only a key statutory requirement for NHS organisations, but also provides important and valuable insights into the financial governance of the organisation. The audit process itself can be a challenging one for all involved with tight timelines and complex issues to resolve.
The NHS England audit and assurance guidance
As explored in HFMA’s briefings on the NHS external audit market,
As the current year-end approaches, it is helpful to reflect on previous years’ positive and negative experiences to plan for an audit that runs as smoothly as possible. This briefing aims to support members by summarising the current audit context and sharing top tips from those involved.
Background
All NHS bodies are required to produce a set of financial statements, have them audited, and publish them as part of their annual report and accounts. NHS trusts and integrated care boards (ICBs) are required to prepare their annual report and accounts in accordance with the Group accounting manual (GAM)
The annual report and accounts must be prepared and audited in line with the DHSC timetable.
As well as the annual report and accounts, it is management’s responsibility to ensure summarisation schedules are prepared and audited in accordance with the timetable. Summarisation schedules are the method of collecting accounts data by DHSC and NHS England for accounts consolidation purposes. The content within the summarisation schedules must be consistent with the annual report and accounts, as audited by local auditors.
On completion of the audit, auditors are required to issue an auditor’s annual report (AAR) bringing together all of the auditor’s work over the year. The AAR should be published at the same time as the opinion on the financial statements for local NHS bodies and include a summary of the work on the accounts opinion; commentary on value for money (VFM) arrangements work; recommendations and follow up.
What is an external audit?
The statutory requirement is for both an audit of the financial statements and VFM. The Code of audit practice (Code)
The 2020 Code applied to NHS audits for the first time in 2020/21, introducing significant changes to auditors’ work on arrangements to secure value for money and audit reporting. A VFM commentary is required covering financial sustainability, governance and improving economy, efficiency and effectiveness. There is also the requirement to make a recommendation where significant weaknesses are identified.
This briefing focuses on the audit of the financial statements and does not consider the other Code requirements or other assurance work undertaken by auditors.
The Code requires compliance with auditing standards issued by a relevant regulatory body which is the Financial Reporting Council (FRC)
Quality reviews of audits are undertaken by the FRC’s Audit Quality Review Team (AQRT) and ICAEW’s Quality Assurance Department (QAD).
The auditor will need to obtain reasonable assurance by obtaining sufficient appropriate audit evidence to reduce audit risk to an acceptably low level. Some of the key terms involved include:
- Audit risk (ISA 320): the risk that the auditor expresses an inappropriate audit opinion when the financial statements are materially misstated.
- Significant risk (ISA 315): an identified and assessed risk of material misstatement that, in the auditor’s judgment, requires special audit consideration. In accordance with ISA 315, the auditor will identify and assess the risks of material misstatement through understanding the entity and its environment.
- Audit evidence (ISA 500): information used by the auditor in arriving at the conclusions on which the auditor’s opinion is based. The quantity of the audit evidence needed is affected by the auditor’s assessment of the risks of material misstatement and, also by the quality of such audit evidence.
- Materiality (ISA 320): the auditor’s determination of materiality is a matter of professional judgment - a key element being whether misstatements at that level could influence the decisions of users of the financial statements.
The revised ISA 315 Identifying and assessing the risks of material misstatement, effective for the audits of financial statements for periods beginning on or after 15 December 2021, is designed to drive robust and consistent risk identification and assessment. This affects the way in which auditors design and perform audit procedures and has resulted in an increased amount of work to understand and document a detailed understanding of the NHS body and the environment that it operates within.
Revisions to ISA 240 The auditor’s responsibilities relating to fraud in an audit of financial statements have also been made to clarify expectations and add specific considerations in some areas.
The main element of the audit is the year-end audit. However, the audit is an ongoing process throughout the year and in most cases involves regular meetings and an interim audit. The key elements of the audit process are set out in figure 1.
Figure 1: An audit in a nutshell
On conclusion of the audit, the external audit report is issued and audited accounts submitted to NHS England. Each NHS organisation also publishes its annual report and accounts on its website. HFMA’s briefing
External audit capacity and procurement
In recent years, some NHS bodies have found it difficult to appoint an external auditor, with little or no interest being shown in invitations to tender to external audit services. There are a number of issues leading to the current issues in the NHS external audit market, some of which result from even more difficulties in the local government sector.
A number of high profile cases of audit failures has resulted in a raft of reviews of the UK audit market. A white paper
There are a number of areas commonly identified for improvement such as judgements and estimates, valuations and the completeness of transactions. In all cases, there is often an insufficient challenge of the facts presented by management and insufficient evidence obtained.
The combination of this increased auditor regulation and audit scope, along with: constrained public sector auditor capacity; historically low audit fees; the need for audit firms to split their audit and non-audit work (with non-audit work being more attractive); and a perception that some NHS organisations do not value the work of their auditors, means that the market is no longer as attractive as it once was.
These issues are explored further in HFMA’s briefings on the NHS external audit market.
A package of cross-system measures to clear the audit backlog and put the system on a sustainable footing are set out in Local audit delays: joint statement on update to proposals to clear the backlog and embed timely audit.
The NHS audit experience
Both the preparation and audit of the accounts to standard and time can be a challenge, particularly with an increase in complexity of arrangements that NHS bodies are entering into requiring increased accountancy knowledge. Examples of complex areas that add pressure and time include:
- complex subsidiaries
- sale and leaseback of assets
- property disposals
- complex valuation judgements regarding modern equivalent asset/alternative site property valuations
- PFI accounting
- specific work regarding management override of control, particularly in relation to achievement of the year end position
- accruals and provisions
- agreement of balances
- cashflow statements
- introduction of the international financial reporting standard (IFRS) 16 on leases.
Recent HFMA year-end surveys in 2022
The length of time taken to prepare and finalise the accounts is the main concern identified by NHS bodies in the surveys. Auditors are also concerned about the quality of draft accounts and the pressure on NHS bodies to report a particular financial position.
The 2022/23 survey confirmed the application of IFRS 16 as a new area of reporting challenge. Documentation of judgements and estimates, remuneration report disclosures (requiring interactions between multiple teams), agreement of balances and capital accounting remain key issues,
Since the preparation and audit of the 2019/20 annual report and accounts, during the first Covid-19 lockdown, significant amounts of the accounts preparation and audit work has been completed remotely. However, there is now a shift back to on-site auditing, so preparers and auditors should together consider:
- on-site and remote arrangements: the amount of on-site and remote working is likely to differ across NHS organisations with not all key individuals necessarily being available on-site all the time. Good planning and ongoing communication is needed to ensure everyone knows who is available, where and when throughout the audit. A communication plan, frequent check-ins and a shared queries log are key features for an effective audit.
- Inventory: alternative arrangements to the usual auditor stock take attendance for assurance over stock may have been in place during the pandemic. Arrangements need to be put in place ahead of the year-end to ensure auditors know when stock takes are happening so they can arrange attendance as required.
It is good practice for local auditors and clients to hold a de-brief shortly after the audit is concluded to consider any lessons learnt. Experience from the previous year should be considered together at the planning stage to best mitigate against any potential difficulties. As challenges increase for both preparers and auditors, it becomes essential that all involved work together to make the process as smooth as possible.
What works
Figure 2: The basics for an effective external audit
It is the responsibility of the NHS body’s management to have in place an effective system of internal control for day to day accounting, and a well designed and implemented financial reporting and close-down process, including controls over all key estimates and judgements.
Based on feedback from auditors, finance professionals and non-executive directors (NEDs), the most essential ingredient for a smooth external audit is seeing the audit as a joint effort with ongoing discussion of plans and issues. For example, are there clear expectations and agreed actions where there is a risk to readiness such as poor working papers, complexity of accounting items or auditor resource restraints?
Common themes for a successful experience include: understanding the audit focus; ongoing communication; clear project management; and high quality documentation. What works well for one audit may be different from that of another, but the key is to discuss each area to determine what will work best for all involved. The basics for an effective audit are set out in figure 2 and common areas that work well are summarised in figure 3 and explored further below.
Figure 3: Good practice for a smooth external audit
| Finance teams should..... | External auditors should..... | Non-executive directors should..... |
|---|---|---|
| Planning | ||
| Engage early with auditors, staff involved (finance and non- finance) and audit committee NEDs over both plans and new and complex areas, providing early accounting papers on such items to go through governance. Ensure NHS wide issues or those arising from prior year or interim work raised are addressed. | Engage early and meet regularly with director of finance (DoF) and finance team to identify potential risk areas and provide clear expectations for audit, set out in a requirements schedule. It may be practical to agree a staggered schedule of working papers so finance can prioritise what auditors need first. | Engage early with DoF and auditors via regular discussion, briefings, auditor progress reports and private meetings with auditors as required. |
| Agree plans for interim and final audit including timetable, accommodation, working paper requirements and a process for amending the plan where necessary whilst keeping the completion date unchanged. | Agree a timetable for completion with dates for interim and final audits including a process for amending the plan where necessary whilst keeping the completion date unchanged. | Understand the process for preparing the accounts and the audit arrangements and challenge where necessary. |
| Provide training on process and issues to finance, NEDs and those outside finance. | Identify training needs to ensure teams are appropriately trained in both external audit and NHS accounts. | Monitor progress on previous recommendations and ensure actioned. |
| Prepare and agree a detailed timetable for the preparation and review of the annual report and accounts including all who have a role, both inside and outside of finance. This should include plans to ensure high quality, timely working papers. | Review papers as they are provided and undertake testing in a timely manner. Consider initial testing of any complex areas at interim and discuss potential impact on the final visit. | Undertake early review of officers’ papers on areas such as judgements and estimates, accounting policies, disclosure checklist and ensure time and knowledge to challenge with finance teams. |
| Co-ordinate annual report preparation using one person to lead the overall process including communication with all involved, particularly those outside finance, and overall review. | Plan annual report review, including remuneration report, by understanding arrangements for preparation, particularly for information provided from those outside of the finance team. | Review the comment on the annual report, including remuneration report, before the final committee meeting. The committee should use knowledge of the NHS body to review, and ensure they are comfortable with processes adopted by management. |
| Work with those outside of finance (i.e.legal, HR, internal audit, local counter-fraud and communications) to review potential issues and prepare clear papers setting out this process. | Provide regular updates for finance and NEDs of both organisational and wider issues. | Understand key changes to organisational arrangements and activity as well as accounting updates and use to robustly review draft accounts. |
| Undertake quality review of draft annual report and accounts and working papers with documentation of DoF and accounting officer sign off. | Provide clear timely findings of interim work so that these can be acted on before final visit. | Review and challenge draft accounts as early as possible. |
| On site visits (whether in person or remote) | ||
| Be organised, open and clear including use of weekly catch up meetings. | Be organised, open and clear including use of weekly catch up meetings. | Be aware of the audit timetable and ask to be kept up to date in a timely manner of issues arising. |
| Be available and provide a schedule of who is responsible for each key area and when they are available. | Be available and provide a schedule of when auditors will be completing the audit (on site and remotely). | Raise comments early on draft accounts and annual report rather than holding them back for the final committee meeting. |
| Keep minimal account versions actioning agreed changes ideally together with changes highlighted for review. | Be clear on any additional testing identified and agreed amendments you are expecting to see on completion. | Understand misstatements, corrections and NEDs’ role in considering adjustments identified by audit. |
Communication
Ongoing, clear, and honest communication is the number one pre-requisite to a smooth audit. This covers both informal and formal communications between all involved – auditors, staff (inside and outside finance), NEDs and experts. It is good practice to put in place an agreed written protocol with relevant teams, such as internal audit and local counter fraud services, to document the timing and scope of assurances which external audit expect to be shared.
Early discussion of any new, significant, complex, or unusual items is essential, supported by a paper from finance and a timely audit response. This avoids technically complex discussions within the final audit timeframe and avoids a climate of distrust which will arise if the auditor identifies an issue that the NHS body has not previously raised. Figure 4 sets out top topics for early discussion with auditors.
Figure 4: Topics for early conversations with auditors
Auditors should be clear on expectations, discussing working paper requirement schedules, audit timings and implications of issues arising. Discussions on how the audit will best work for all are key and can consider items such as the opportunity to use technology, how best to raise queries and liaison with staff outside of finance. Audit progress updates for NEDs are helpful, as well as the opportunity to hold private discussions with the auditor as needed.
For the audit visits, it is useful to hold regular catch-up meeting to cover: progress, audit queries and sticking points; impact of errors identified; extended testing; amendments; and reporting consequences. This will help any concerns on how the audit is going - from both finance and the auditor’s perspectives - to be raised and addressed quickly. It can be useful to have one key liaison contact at the NHS organisation for all audit queries, to log them and ensure timely quality responses. After the audit is completed a debrief meeting should be held to consider what worked well and not so well to feed into planning for the next audit. As the auditor will need to move on quickly to other audits, it is important to do this before the lessons from the audit experience are lost.
Project management
Good project management helps to strengthen a collaborative approach, clarify expectations and ensure ongoing monitoring of progress. It should be used to remind everyone of the times when the audit needs to be prioritised and how this can work in practice. All areas of the audit must be covered including the financial statements; value for money; annual report and remuneration report; as well as whole of government accounts.
Examples of areas to be covered include:
- liaison meetings throughout the year
- audit committee attendance and requirements
- when and how working papers will be provided, for example, options for electronic upload
- what information is needed from outside finance and how this will be obtained and supported
- wider governance issues, including alerting auditors to any relevant regulatory issues, including those relating to Care Quality Commission (CQC) findings and who, at executive level, is leading on them where relevant
- the annual report can often be fragmented or forgotten as part of the sign off timetable so it is important to agree who, what, when and how for each of its sections – it is helpful to have an overall lead (both for finance and audit) to coordinate its preparation and review
- arrangements for the audit including:
• accommodation for on-site visits, with minimal changes and physically close to finance
• who will be available and when (finance team and auditors) and communication plan
• timing and attendees for catch up meetings
• who will be responding to audit queries and a realistic time for responses
• IT issues such as read only access to ledger and wi-fi access - internal quality review arrangements
- sign-off process.
Documentation and evidence
High quality working papers with relevant and meaningful evidence are needed to demonstrate that the transactions and account balances are supported allowing:
- the director of finance to have confidence in the accounts and analysis readily available to support any review queries
- the accountable officer to have the confidence to sign the annual report and accounts
- NEDs to confidently approve the annual report and accounts
- the external auditor to be able to gain sufficient, appropriate audit evidence to support their audit.
The preparation of the annual report and accounts is the responsibility of the organisation and the accounting officer’s statement is very similar to the audit opinion including confirmation on items such as: compliance with reporting requirements; inclusion of appropriate accounting policies; reasonableness of judgements and estimates; preparation is on a going concern basis; and that the annual report and accounts taken as a whole is fair, balanced and understandable. The accounting officer will need to satisfy themselves they have sufficient assurance to make this statement and NEDs will need to be satisfied by evidence where challenges are made. Clear documentation is a key component for this.
For auditors, ISA 500 is clear on the requirements of appropriate and sufficient audit evidence. This will include the need to evidence the accuracy and completeness of information provided by management, as well as whether it is sufficiently precise for the auditor’s purposes. When using the work of a management’s expert, such as a valuer, the auditor will also be required to evaluate the competence, capabilities and objectivity of that expert; obtain an understanding of the work of that expert; and evaluate the appropriateness of that expert’s work as audit evidence.
Audit is more than discussion – understanding the assumptions underpinning key decisions should be a starting point for the auditor not the main audit procedure. Evidence must be sufficient and appropriate, recognising the importance of quality over quantity. This will need to be subject to robust review, challenge and corroboration by the auditor. If the NHS organisation can present third party evidence to support their working papers, then this is ideal. Where judgements and estimates have been made then the thought process and any supporting evidence should be documented. This was covered in the audit conference session on developing a collaborative approach with audit.
Working papers should be produced in a timely manner, be electronic and include a summary schedule of all working papers provided with appropriate cross referencing to detail. For each account balance an individual working paper should be provided which agrees from the accounts to the trial balance, includes narrative and evidence and the person responsible for preparation. It should also include an analytical review to ensure consistency with in-year reporting and activity that provides the reason for variance from expectations. It is also helpful if working papers are written with the assumption that the reader does not know the NHS or the organisation. Auditors should provide, and discuss, a list of expected working papers as early as possible.
Specific areas where working papers can often be strengthened include:
- Agreement of balances: good explanations and evidence need to be maintained for mismatches throughout the year
- Judgements and estimates: documentation of thought process and evidence of underlying data is essential, along with the controls over making judgements and estimates
- Year-end receivables (debtors) and payables (creditors): a full breakdown of the final year end debtors, rather than in year transactions is needed to test the final balance
- Reviews completed outside finance: discussions such as with human resources on staffing and employment related issues or legal on potential impact of legal cases should be documented
- Overall final review for internal quality assurance: keeping documentation of the process provides helpful assurance over what has been reviewed
HFMA’s briefing, Year-end working papers: a good practice guide
Understanding the audit focus
As set out in figure 1 above the audit testing strategy is risk based and, in accordance with ISA 315, assesses the risks of material misstatement in the financial statements through understanding the entity and its environment including the entity’s internal control. There are some areas that will always be seen as a higher risk, many of those flagged in audit quality reports mentioned above. These include:
New and significant items
Auditors will always need to review new, significant or unusual transactions. It is important to understand key changes to the financial statements to be able to appropriately support these. The HFMA briefings on financial reporting
Revenue recognition
Under ISA 240 there is a presumed risk of fraud in revenue recognition. The audit will therefore have a specific focus on revenue transactions such as contract variations, disputes and unrecoverable debt. As set out in Practice note 10: Audit of financial statements of public sector bodies in the United Kingdom (PN10),
Management override of controls
Under ISA 240 there is a presumed risk of management over-ride of controls and there are standard procedures required by the ISA. Auditors will need to be able to articulate specifically where the risk manifests itself in the financial statements and their planned response. The audit is therefore likely to have a specific focus on areas such as journals, one-off unusual transactions, accruals, prepayments and other accounting estimates.
Judgements and estimates
Auditors will apply professional scepticism to judgements and estimates. ISA 540 (revised) Auditing accounting estimates and related disclosures
An accounting paper is helpful to demonstrate the thought process that management has adopted for both NEDs and auditors to review and challenge - and these can often be provided early in the year. Examples of things to consider and document are: the justification for taking a particular approach, including references to the standard, particularly if that has changed from prior periods; consistency with other assumptions; realism of assumptions; what alternative assumptions have been considered and why these have not been selected; and what underlying data has been used.
Asset valuations
This is an area where material figures are involved and a small percentage error on a large balance can lead to a non-trivial difference. Auditors will pay particular attention to depreciation and how the public dividend capital (PDC) calculation has been derived. Alongside the significant levels of judgement and estimate involved, the level of reliance by management of work of an external expert means this is a key area of focus for audit. As such, the auditor will look at changes in assumptions; asset lives; whether management understand and have challenged the experts’ assumptions; and underlying data. Further information on valuation issues is included in the HFMA briefing on property, plant and equipment.
Going concern
There are continuing financial pressures within the NHS and it is important that the NHS body’s management and the auditor are aware of the requirements for assessing going concern in the public sector context. As per PN10
Conclusion
Looking ahead, the pressure on the public sector external audit market is set to continue, with challenges including tight timeframes, resource constraints and a focus on audit quality. NHS bodies have a statutory duty to appoint an auditor. There is a higher risk for NHS bodies that they will struggle to meet their statutory duty to appoint an external auditor due to the current external audit market issues. Early planning, including briefings to NEDs on the potential issues, ongoing engagement with auditors, and embedding processes for a constructive working relationship are essential.
To deliver a quality audit to time, as well as ensuring the experience is as painless as possible for all involved, requires ongoing planning, continuous communication and understanding of the pressures faced by both parties. Based on members’ experiences, the key to a successful audit is a collaborative approach with early discussions of any issues arising. This briefing has shared tips from those involved in public sector audit that they have found to help the audit of the financial statements go as smoothly as possible.
As Kendre Chiles, deputy finance director at University Hospitals of Derby and Burton NHS Foundation Trust, commented during her session at HFMA’s 2023 pre-accounts planning conference,
Related content
Audit conference 2024
This online event offers indispensable practical insights and serves as a valuable platform for audit committee chairs and members to engage
2023/24 year-end reminders for NHS audit committees
This paper provides NHS non-executive directors with key reminders as they review their 2023/24 annual report and accounts.