Briefing / External audit reports: the role of the audit committee

28 March 2024 Lisa Robertson
1 CPD hour

Please login to check if you have access to this content.

This short paper is intended to support audit committee members to easily understand the range of external audit reports and additional powers.

In the context of ongoing operational and financial pressures in the NHS, the need for strong financial and governance arrangements is particularly important. Auditors provide a key source of information to audit committee members, and the public, in determining and reporting on the financial statements, VFM arrangements and other matters.

The audit committee has a crucial role in scrutinising these arrangements. Committee members must ensure that they fully understand external audit reports so that they are in a position to effectively scrutinise and challenge actions being taken to address issues being raised.


This paper aims to support audit committee members to scrutinise and challenge the effectiveness of their organisations’ arrangements to manage finances and secure value for money (VFM).

With ongoing operational and financial pressures in the NHS, the need for strong financial and governance arrangements is particularly important.  The audit committee has a crucial role in scrutinising these arrangements. Auditors provide a key independent source of information for audit committee members, and the public, in determining and reporting on the financial statements, VFM arrangements and other matters. 

As recommended in the NAO reportNAO, Local auditor reporting in England 2018, January 2019, ‘local public bodes should take prompt and effective action in response to weakness in arrangements to secure VFM. This includes effective scrutiny and challenge by those charged with governance to hold the executive to account’. The Code of audit practice (the Code)NAO, Code of audit practice, April 2020and Auditor guidance notes (AGNs)NAO, Auditor guidance notes, March 2024aim to support this.

By providing an overview of external auditor reports and auditors’ additional powers and duties, this short paper is a helpful reference guide to support audit committee members as they consider external audit reports. Further detail on external audit and the role of the audit committee is provided in chapter 10 of HFMA’s NHS audit committee handbookHFMA, NHS audit committee handbook, March 2024.

Responsibilities of audit committees

There is a statutory requirement for every NHS organisation to have an audit committee, as set out in HM Treasury's guidanceHM Treasury, Audit committee handbook, updated September 2021, to ‘support the board and accounting officer by reviewing the comprehensiveness and reliability of assurances on governance, risk management, the control environment and the integrity of financial statements'.

The audit committee performs a crucial role in the governance of NHS organisations, with members responsible for scrutinising the risks and controls affecting the business. As set out in HFMA's NHS audit committee handbookHFMA, NHS audit committee handbook, March 2024, the committee must ‘ensure the organisation operates effectively and meets its statutory and strategic objectives and provides the board with assurance that this is the case’. 

There are a number of documents produced by NHS organisations setting out how they have managed their resources – a key one being the annual report and accounts. This presents the story of the organisation’s activities during the previous financial year. The accounts present the financial position and performance while the annual report sets out what the organisation has done, and is doing, in order to meet its objectives and to demonstrate that it is adding value to its members, patients, public and other stakeholders. 

The form and content of the annual report and accounts must meet specific requirements – these are set out in the Department of Health and Social Care’s (DHSC’s) Group accounting manual (GAM)DHSC, Group accounting manual 2023/24, updated January 2024for trusts and integrated care boards (ICBs) and the NHS foundation trust annual reporting manual (FT ARM) for foundation trustsNHS England, Foundation trust annual reporting manual,  February 2024 

The annual report and accounts includes the governance statement. This focuses on the stewardship of the organisation and draws together evidence on governance, risk management and control. It sets out how the accounting officer discharged their responsibility to maintain a sound system of internal control, explaining how the board, audit committee and other board committee responsibilities work, as well as declaring significant internal control issues affecting the organisation. 

The audit committee is required to review the draft annual report and accounts before it is submitted to the board for scrutiny and approval. Audit committees are encouraged to review the financial position and governance issues throughout the year, as well as the year-end. Further guidance is provided in the HFMA briefings, How to review and scrutinise the numbers during the yearHFMA, How to review and scrutinise the numbers during the year, April 2022 and How to review and scrutinise the annual accountsHFMA, How to review and scrutinise the annual accounts, June 2022

Auditors’ responsibilities

Auditors are central to the audit committee’s role as they provide both assurance and insight into the management arrangements within the organisation. Throughout the year internal and external audit provide a number of reports, which audit committee members can draw from. This briefing focuses on those provided by external audit.

The Local Audit and Accountability Act 2014 (the Act)Local Audit and Accountability Act, 2014sets out the framework for local external audit for local authorities and NHS bodies in England. As required by the Act, the Comptroller and Auditor General must prepare the CodeNAO, Code of audit practice, April 2020 setting out what auditors are required to do to meet their statutory responsibilities. In accordance with the Code, and its associated guidance notesNAO, Auditor guidance notes, March 2024, auditors provide independent assurance that local bodies are spending and accounting for public money properly.

As well as complying with the Code, auditors also have to meet the requirements of the International Standards on Auditing (ISAs)Financial Reporting Council, current auditing standards, as at March 2023. The external auditor is required to produce a number of reports such as: the audit plan; a report to those charged with governance (TCWG); audit report(s); the auditor’s annual report; and the audit completion certificate.

The audit plan covers both the work on the audit of the financial statements and arrangements to secure VFM. It sets out the auditor’s view of significant risks at the start of the year. It should facilitate timely discussions between the auditor, management and TCWG. The auditor will keep the audit plan under review, providing updates throughout the year, and therefore support committee members to provide ongoing scrutiny and challenge.

The report to those charged with governance (the ISA 260 report) sets out findings from external audit work and aims to ensure that TCWG are aware of, and have considered, any issues arising from the audit before approving and adopting the annual report and accounts. There is no requirement to publish this report - it is up to the local organisation to determine whether it wishes to publish its audit committee papers, including the report to TCWG.

The auditor will ask TCWG to review a letter of representation signed by the accountable officer. In some cases, the chair of the audit committee will also sign the letter representing TCWG. This is a formal letter to the auditors covering matters the auditors want confirmation on such as:
•    areas where TCWG or management have had to make a judgement
•    that the representations made by management are accurate and reasonable
•    that TCWG agree that errors identified by the auditors should be adjusted or left unadjusted.

The auditor’s annual report (AAR) also sets out the audit findings. This replaces the annual audit letter previously required by the Code and should be issued at the same time as the opinion on the financial statements for local NHS bodies. With the removal of previous special reporting provisions relating to value for money (VFM) arrangements, introduced during the Covid-19 pandemic, auditors will be required to complete their work on VFM in time to report significant weaknesses in arrangements in the opinion on the financial statements. Where auditors are unable to complete their work to satisfy themselves as to whether there are significant weaknesses in VFM arrangements, they will not be able to issue their opinion on the financial statements until they have completed their work.

The AAR is a public document and must be made available to members of the public free of charge – published on the body’s website. The AAR includes: a summary of the work on the accounts opinion; commentary on VFM arrangements work; recommendations and follow up; and details of any other powers exercised such as the issuing of a public interest report. 

The audit completion certificate ‘closes’ the audit for the audit period covered, confirming that the audit has been completed in accordance with the Code and marking the point when the auditor’s responsibilities have been discharged. The auditor should not certify completion until all of their planned work is complete. NHS foundation trusts can only lay their annual report and accounts once the audit report (opinion) is accompanied by the audit certificate. All NHS bodies need to include the audit certificate in their annual report and accounts, therefore cannot publish them without this.

External audit reports

At the completion of the audit, the auditor will issue an audit report covering the areas as set out in more detail in the sections below. Where auditors are not satisfied that financial statements give a true and fair view, they issue a non-standard audit report. A non-standard audit report may also be issued where the auditor decides to draw attention to a matter that they consider readers of the financial statements should be aware of. Under the 2020 Code, where auditors identify a significant weakness in the body’s arrangements to secure VFM, they report this matter by exception and raise a recommendation in relation to the issue(s). 

‘Materiality’ and ‘significance’ are key terms referred to in external audit reports. An item is considered to be material if, individually or in aggregate, it could reasonably be expected to influence the economic decisions of users, if those decisions are made based on the contents of the financial statements. Materiality is based on the auditor’s professional judgement which will take into account the size and nature of the items, as well as surrounding circumstances.

As set out in the CodeNAO, Code of audit practice, April 2020, the concept of ‘significance’ applies to the auditor’s wider responsibilities that are not addressed by the auditor’s assessment of materiality for the audit of the financial statements. A matter is significant if, in the auditor’s professional view, it is reasonable to conclude that the matter would be of interest to the audited body or the wider public’.

Opinion on the financial statements

Auditors give an opinion on whether the financial statements are prepared properly, free from material error and give a ‘true and fair’ view of the organisation’s financial position. The opinion is qualified if the auditor disagrees with an item’s accounting treatment or has been unable to obtain sufficient supporting evidence. An unqualified opinion is often called a clean opinion.

There are different types of qualified opinions depending on the impact of the issue in question on the financial statements. Qualifications can be issued as ‘except for opinion’ based on limitation of scope or disagreement; an ‘adverse opinion’ or a ‘disclaimer of opinion’.  

In giving the opinion, an emphasis of matter is used when auditors need to draw attention to a particular aspect of the accounts, but which does not affect their true and fair opinion. 

Auditors report any going concern issues as a material uncertainty relating to going concern i.e. whether it can reasonably expect to continue to function for the foreseeable future (usually at least 12 months). As per the practice note for the audit of financial statements in the public sector (PN10)Public Audit Forum, Statement of recommended practice – Practice note 10: Audit of financial statements of public sector bodies in the United Kingdom (Revised 2020), December 2020 , ‘if the financial reporting framework provides for the adoption of the going concern basis of accounting on the basis of the anticipated continuation of the provision of a service in the future, the auditor applies the continued provision of service approach’. 

Management should refer to the GAMDHSC, Group accounting manual 2023/24, updated January 2024 and FT ARMNHS England, Foundation trust annual reporting manual,  February 2024  when assessing going concern. Further detail is provided in the NAO guidance

Opinion on regularity (ICBs only)

Auditors give an opinion on whether or not an ICB’s income and expenditure is in accordance with laws and regulations. The regularity opinion is qualified if an ICB overspends against its financial spending limit or incurs unlawful expenditure. If the regularity opinion is qualified, the governance statement and the accountable officer’s statement should also refer to the issue that caused this.

Auditor’s work on value for money (VFM) arrangements

The 2020 Code included a significant change in the way auditors were expected to approach and report their work on VFM arrangements. A VFM commentary replaces the binary VFM conclusion. It covers financial sustainability, governance and improving economy, efficiency and effectiveness. There is also the requirement to make a recommendation where significant weaknesses are identified. AGN 03NAO, Auditor guidance note 3, January 2023provides detail on auditors’ work on VFM arrangements.  

The audit report on the financial statements will only include reference to the VFM work where the auditor has identified a significant weakness. The auditor’s annual report will include the auditor’s commentary.

External audit additional reporting powers

External auditors also have a range of statutory powers to issue reports or recommendations that require NHS organisations to publicly consider the matters reported to them and publish their response, as set out below. These additional powers are important tools for the auditor and enable him/ her to bring attention to issues and ensure prompt action. 

Public interest report

(Section 24, Schedule 7(1)(1) Local Audit and Accountability Act 2014) for NHS trusts and ICBs and Schedule 10(3) National Health Service Act 2006 for foundation trusts)

Addressed to the public, a public interest report is issued when the external auditor considers there is a matter which they need to draw explicitly to the public’s attention. They can be published at any time. The public interest report imposes additional requirements on the organisation, including holding a public meeting to consider the report and publishing a formal response. Public interest reports can be made at any time throughout the year. 

Statutory recommendation (not applicable to foundation trusts) 

(Section 24, Schedule 7(2) Local Audit and Accountability Act 2014)

Addressed to the NHS body, a statutory recommendation is issued when the external auditor needs to make a formal recommendation to take action. The action required will be about issues such as failing to deliver planned cost savings or failure to address weaknesses highlighted by independent reviews. Recommendations require formal, public consideration and response. They are often referred to as Schedule 7 recommendations. A statutory recommendation can be made at any time during the year.

Section 30 referral (not applicable to foundation trusts) 

(Section 30 Local Audit and Accountability Act 2014)

Addressed to the Secretary of State, the auditor is legally required to make a section 30 referral where the organisation is about to, or has entered into, a transaction that the auditor believes is unlawful. For example, an ICB exceeding its expenditure limit or an NHS trust failing to meet the break-even duty. 

Schedule 10 referral (only applicable to foundation trusts) 

(Schedule 10(6) National Health Service Act 2006)

Addressed to the regulator, a section 10 referral is legally required when an NHS foundation trust is about to make a decision or enter into a transaction that the auditor believes would be unlawful.  

NAO guidanceNAO, Auditor guidance note 7, January 2023 provides further detail on external audit additional powers and duties. 

Auditors follow an integrated audit approach. What they find in one part of the audit will inform the different elements of the audit report. There are links between additional reporting powers and the opinions given by the auditor. For example, if an ICB breaches its expenditure limits, it will be referred to the Secretary of State as a section 30 referral and receive a qualified regularity opinion. It will also be considered as part of the auditor’s work on VFM arrangements. 

Acting on audit reports

A non-standard report from the external auditor is a public, independent warning sign that that must be taken seriously and acted upon. This is an important role of the audit committee in the stewardship of taxpayers’ funds. This is echoed in the findings and recommendations of the NAO report on local auditor reportingNAO, Local auditor reporting in England 2018, January 2019 and the Public Accounts Committee reportHouse of Commons Committee of Public Accounts, Auditing local government, March 2019 recommending that ‘Departments should set out, by the end of September 2019, clear expectations of how local bodies should respond to weaknesses reported by local auditors in 2018/19, including the potential consequences for local bodies who fail to improve’ .

The requirements for the approach and reporting of VFM work, including clear recommendations, will provide valuable commentary for organisations to discuss and act on. 

Where issues are communicated by auditors - during the year for example through audit planning reports, as part of a qualification or by audit recommendations - audit committee members must ask themselves whether they are providing appropriate challenge on actions taken by the organisation to address the issues. To do this, they need to: 

a)    understand the audit risks and qualification and consider whether it is consistent with their understanding of the organisation
b)    review current and proposed actions being taken to address the issue(s)
c)    follow up and challenge on an ongoing basis whether agreed actions are being undertaken and are sufficient. 

Audit committee members have an important role in seeking assurances and providing challenge on plans, they should also understand how their organisation fits into the wider system position. Auditors only report on individual statutory bodies, therefore it is important that the audit committee looks at how it is getting assurance in areas not covered by local audit, such as how partnerships are held to account for joint decisions.


Audit committees have a number of key responsibilities and to ensure these are fulfilled effectively, members need to make use of all sources of information available, including reports from management and auditors. 

This paper explains the different audit reports and how they relate to each other. Committee members must ensure that they have the time and skills to fully understand audit reports so that they are in a position to scrutinise and challenge actions being taken to address issues the being raised. Although a number of key reports are provided at the year-end, issues being raised at that point should not be a surprise. The audit committee also has an important role in ensuring that issues regarding the body are reported in a transparent way.

Recognising the significant change and challenges faced by the NHS today, the audit committee role to oversee strong financial and governance arrangements is as vital as ever.

CPD accredited
CPD accredited logo