Carillion's Shadow: The Lost Opportunity of Audit Reform

This episode of Governance Watch explores the UK government's decision in January to halt the audit reform process that began after Carillion's collapse in 2018. Host Gavin Hinks discusses with Anne Kiem, CEO of the Chartered Institute of Internal Auditors, and Dean Beale from the Center for Public Interest Audit Research, whether this represents a lost opportunity. 

Transcript

This Governance Watch podcast is brought to you in association with Nasdaq Governance Solutions, supporting boards and leadership teams with technology and insights to navigate today's evolving governance landscape.

Speaker 2

Welcome to Governance Watch, the podcast from Board Agenda, your essential source for governance intelligence.

Hosted by the Board Agenda editorial team. We bring you insightful conversations with Board members, c suite executives, governance leaders, and investors, delving into the biggest issues shaping corporate leadership today. For expert perspectives and strategic insights, stay with us as we explore the leadership of business.

Governance Watch is a board agenda podcast.

Speaker 1

Hello, and welcome. My name is Gavin Hinks, and this is Governance Watch, the podcast from board agenda about all things governance.

In this program, we're taking a look at audit reform. A project to change audit, the audit market, and audit regulation had been underway since the collapse of Carillion back in two thousand and eighteen. But in January, following parliamentary investigations, three government reviews, a white paper, and years of debate, the process was brought to a halt. The government said improvements had been made in audit in any case, and it wanted to focus on its growth agenda. Many in the sector see the cancellation as a lost opportunity. So to discuss whether it is and what happens next, we have two special guests.

Anne Kaim, chief executive of the Chartered Institute of Internal Auditors, the professional body for internal auditors up and down the country joins us. And with her is Dean Beale, executive director at the Center for Public Interest Audit Research and Policy Institute. Welcome to both of you. But before we get into questions and discussions, let's just quickly recap what may have been lost in the decision to bring audit reform to an end.

The plan was to give watchdogs new powers of investigation and the ability to sanction company directors. A new definition of public interest entity to include large private companies was on the cards as well. Other reforms had been jettisoned already, such as resilience reporting. The government will still place the regulator, the Financial Reporting Council, on a statutory footing, and the Corporate Governance Code includes a new provision for companies to report on their internal controls.

But Anne, coming to you first, the minister Blair MacDougall said, and I made I mentioned this already. He said reform was canceled because the audit had already gone through significant improvement since Carillon. That seems like a reasonable reason, doesn't it, to end that whole process of rulemaking?

Speaker 3

Well, thank you very much for inviting me along, Gavin. And I think this is a great topic to be discussing.

Yes, there have been changes and improvements in the way audit's done.

But I think we'd be kidding ourselves if we think that we're there.

There's been a lot of change? Yes. Is it sufficient? I would argue no. We're still seeing collapses coming through despite these changes.

So whatever we have a system that's not quite working and leading to surprising collapses rather than the ones that you can see coming, I think we still need reform. There are things we're missing. And you mentioned and we discussed earlier the resilience statements, which I think most of us from the outside think were really good things, that add an additional assurance, and I think that that's what we're missing. We're missing the teeth for ARGA.

Okay, they say it's coming, we don't know when, but I think there's a lot more we need about what a company's doing and what information are board directors getting. Is it sufficient and is the audit they're getting sufficient for them to make proper judgements on what's going on in the organisations they're in? So I can imagine that actually non exec board members would be keen to see something come through. I think it's disappointing.

Speaker 1

What were the changes that happened that has convinced government that improvements have been made? Because the big audit firms didn't wait for regulation really, did they?

Speaker 3

No, of course not, because they could see it coming.

My fear now is changes that made it are actually going to disappear because it's not a requirement anymore. They had to get ready because they were fearful of what would happen if they were just introduced and they haven't even started thinking about it. Like anyone, the minute you hear something's coming in, you start to prepare for it. Now that it's not coming in, fear there may be a, Oh, let's go back to the way we used to do things. And I think that would be detrimental for corporate UK.

Speaker 1

So a worry about standard slipping?

Speaker 3

Oh, I think it's a possibility, absolutely.

Speaker 1

Dean, I wanna come to you with the other part of Blair MacDougall's reasoning, was the growth agenda. We don't wanna do more rule making because we have a growth agenda to pursue. That seems a bit binary. Do you buy that reasoning?

Speaker 4

I mean, you know, the policies that the government was talking about for the audit reform and corporate governance bill had been in incubation for some five years or more.

And the world has moved on very quickly. So I don't think it's necessarily incorrect for the government to reflect and reconsider what its priorities are at the moment.

And you know, clearly it's got a very busy parliamentary agenda and this would not have been a small bill I suspect and it would have taken up a lot of parliamentary time. But you know just picking up some of the points sort of Anne made, you know there has been progress made in this kind of period where the government's been talking about reform. And I'm not sure we will see a rollback on any of those changes.

You know the FRC and the big audit firms have been you know very busy sort of responding to the challenges that placed on the sector in the wake of Carillion eight years ago. So we've seen things like changes to the audit firm governance code. We've seen the introduction of operational separation of audit practice from consultancy in the big firms and a real focus on audit quality and that's borne out by the FRC's own annual review of audit quality. We're seeing year on year improvements in audit quality.

So I don't think we'll see a road back on those changes that have already been implemented. I mean these things do need to be kept under review and the regulatory framework is complex in the UK.

But in terms of the growth agenda, I mean it is about ensuring that you know the UK is a great environment for investment and for you know for growing businesses. And the regulatory environment needs to be proportionate to that. And it also needs to reflect you know, now and not maybe the environment in twenty eighteen or before.

Speaker 1

Just to come back there on that growth agenda issue. One of the key elements to Britain as a secure market is its governance structures and framework.

And surely governance has to move over time. It can't be a static framework.

Speaker 4

Yeah. Yeah. Absolutely. And we've seen, you know, some big changes to the UK corporate governance code which, you know covers a significant proportion of the sort of economically significant businesses in the UK.

So the introduction of things like provision twenty nine which came into force at the start of this year and will apply to year ends from January onwards. Places a lot more responsibility on boards to account for the extent to which they've reviewed and tested material internal controls. And that kind of points the UK a little more towards the US SOX system and also I think places a lot of emphasis on the board's responsibility for the health and resilience of a company. So it's kind of like we're still sort of moving towards the same objectives here but in a slightly different way and a slightly different pace.

I mean the decision to shelve the bill, I think that was disappointing because the bill gives some predictability. It very much shines a spotlight on the issues at the time and that's good for public awareness.

But I think we will still see some progress on some of the areas that would have been covered in the bill but not on all of them. And there were a couple of key areas I think that the decision to share of the bill leaves somewhat up in the air.

One of which is what should be public interest entities in

Speaker 3

the

Speaker 4

UK And the policy proposal that we expected to see in the bill was to extend that definition to more large private companies.

So that at the moment seems to be left up in the air. And the second one was around the accountability framework for company directors and giving the audit regulator the kind of breadth of powers to ensure that directors are doing the right thing and driving the right sort of behaviors amongst directors. And without that, their powers are limited. They're limited to accountants under the accountancy scheme.

And I think that's still something that is a bit of a sort of regulatory lacunae in the UK. The fact that whilst there were duties of existing company law on directors around the production of accounts that are true and fair, The enforcement of that is absent and you know this was gonna be one of the big policy areas for the strengthened regulator.

Speaker 1

Well, I was gonna come to that later but we've brought it up now. And if I can switch this to you, this was a key issue, wasn't it? There were a regulator with a statutory footing was going to get new powers of investigation and potentially sanction powers of sanction against company directors for whatever failures may arise in terms of corporate reporting and maybe even planning of audit. We didn't really know how those powers were going to apply. Why were those powers important?

Speaker 3

I think for exactly the reason Dean has said, it's not just the accountant's fault. It's not the chartered accountant who's in the organization.

It's not just their fault. And sometimes it isn't their fault at all, but there needs to be an accountability. Now, there isn't one sense in accountability, but there's not that legal accountability where they're held to, just other directors are held to task, where, especially in the case of a chief executive, you know, they are responsible for what's going on, but under this, they're still not being held accountable in this form. And I think that that is something that's really remiss, because you can't say that a lot of these things happen in isolation just with one person. The collapses that we've seen have not just been because of one person in most cases.

And we need to see that accountability. I think that everyone should see that that's a reasonable thing to do, although I can understand why if you're a director, you might be a little fearful.

Speaker 1

So the issue here is balance then. Regulatory framework rests on auditors and audit firms. It touches very little on corporate directors except through whatever accountancy schemes they may be members of.

Speaker 3

Maybe.

Speaker 1

Maybe. Yes, indeed. Maybe.

Speaker 3

And there's the issue.

Speaker 1

Right. Ding, you mentioned the public interest entities differ definition. The key there was to get some large private companies included so that they were subject to the regime. Why was that important? And what are we losing there by not having it?

Speaker 4

I mean, it's, you know, the fact that an entity is a public, you know, is designated a public interest entity does bring that broader regulatory framework around audits.

And it's absolutely not a fail safe against failure, absolutely not. But it does mean that there more scrutiny and more regulatory rules around the independence of auditors, auditor rotation, etcetera. So, know, and it's currently applied to listed companies and regulated companies in the financial services sector for example. So it's a recognition there that the public interest entity regime is sort of targeted at systemically important businesses.

But you know, around the time of Carillion or just before Carillion, we had the collapse of BHS.

Again, systemic impact from that, that was a private company but you know, big impact on employees, big impact on the supply chain there.

And you know, was those collapses as well as Carillion that sort of brought these points into the spotlight. Carillion was a public interest entity, BHS was not.

And so I think there was something lost there by and back in September, you know the government indicated there would be further consultation on this and I think that was something we welcomed because the government prior to that had sort of proposed quite a kind of blunt threshold limit for public interest entity status. So if you're a company with more than seven fifty employees and turnover of more than seven fifty million, you could be caught by this. But I think the consultation was a lost opportunity to maybe just kind of test that theory a little bit more as to is that the right definition for public interest entity? And I think we would have welcomed the opportunity to consider that a little further.

I think there are public interest entities that maybe don't require the regime because they're very small. It may just be because they've got some listed debt. And there are other entities that sit below that threshold but are delivering essential public services where unexpected collapse would definitely have some systemic impact. So I think without that consultation we lost the opportunity to help government develop that policy a little further I think. So I hope it's not something that's gone away for good. I think it's quite a live issue particularly if you're a very small business that's caught by the current public interest entity definition. And also for stakeholders in some large private companies that currently fall outside the regime.

Speaker 1

Anne, I think you want to come back in there.

Speaker 3

Well, I was just going to say, I think that there are some really important infrastructure private companies that get missed as well. And I think that Dean's quite right that there have been a number of these that do get caught, but the private companies in the infrastructure area should absolutely be caught in this.

Speaker 1

Anne, one thing that we've mentioned already and I want to come back to is some reforms that have happened, and a big piece of, reform that has changed is provision twenty nine in the corporate governance code. This asks companies to report on their internal controls, but it is in the code.

And what many people had sought was some legislation, primary legislation to set that up as law. Is the code still going to work in making a difference or the code provision still going to work in making a difference. I'll preface this by saying, last week, was at an event, well, which involved a lot of company secretaries, and they were clearly concerned by provision twenty nine and how they were going to report against it. So I wonder, for your money, is it a good thing that it's in the code? Is it going to have an impact?

Speaker 3

It is a good thing that it's in the code, especially as we lost resilience statement so early on. I think it's absolutely crucial that it stays there and that people had held to account on it. Because if you cannot articulate how you are gaining your assurance, then how can anyone else, either investment investors or your supply chain or whatever, how can they have any confidence if you don't have that information yourself and cannot declare it? Now, agree, it's very wide ranging. It is very wide ranging.

And so I guess it's what it will look like in practice that will actually tell us if it's going to be something that's useful and it's something that people are going to take seriously, or if they're just going to pay lip service and say, Yeah, we've looked at this. We're fine.

Speaker 1

Dean, the interesting thing about internal controls is that if you read any report on any audit failure or any corporate reporting failure, controls are always part of the breakdown that led to a crisis and potentially scandal.

Speaker 4

Yeah. No, you're absolutely right. I mean, you know, that is the key driver of a big systemic collapses. And I think this is a positive move. It's gonna be interesting to see over the next twelve months how firms respond to the reporting requirements.

And you know, at the CPIA we will be looking at that across the year to see, you know, obviously companies generally complying or obviously companies generally explaining. But I think it's a good move and you know, one which I think is a positive in so far as I think the UK corporate governance regime, you know, it's a little more nuanced and maybe more prescriptive US regime.

And this is another area where we're sort of, we have the same kind of objective here and that's to make boards really sort of serious around internal controls and accountable for internal controls but doing it in a slightly different way through the UK Corporate Governance Code. So, and I guess the weakness there is you know, what happens if companies are doing it wrong or you know, purposefully doing it wrong and the extent to which you know that there is pressure for them to do it right.

And that pressure can come from the FCA you know potentially it's a breach of listing rules. But I think the pressure will come to bear primarily from stakeholders, from investors sort of you know driving the right sort of behaviors by boards.

It definitely places an additional emphasis on board responsibility here and it's going be interesting to see over the next twelve months as I say how sort of audit committees are grappling with this new requirement.

Speaker 3

Whilst the UK Corporate Governance Code doesn't really make much reference to how you do this, the guidance is very clear in that a primary source for this is in time audit. Now I know you'd expect me to say that because they're my members, but it it appears many, many times in the guidance. And I think that this is where boards really can go, okay, if we've got a properly resourced and listened to internal audit, we'll be able to cover this, no problem.

Speaker 1

Do you get a sense, Anne, that companies are taking it seriously, or are they looking to get away with the minimal possible reporting?

Speaker 3

I think with anything, there'll be a combination of the two. There'll be some companies, because of their boards, who will take this very seriously.

And they tend to be the companies where they really do care about the impact their organisation is having on others.

There will always be some where it will be probably sort of in the short term, in their best interest to ignore it and just pay lip service. So I think there'll be both. But again, this is why we need greater teeth for what we think will be called agar.

They need that statutory responsibility to be able to call people to account.

Speaker 1

I want to come on to that. I just want to stick with the internal controls issue just for one more question because obviously, it's it's in the governance code. The governance code functions on the principle of comply or explain. Do you anticipate anyone explaining why they haven't done an internal controls report?

Speaker 3

Well, we've seen a few instances where they go, We don't think this applies to us. So I think we will see it, and they're the companies that if I were investing my money, I wouldn't be investing in them.

Speaker 1

Big questions for investors at the next engagement meeting.

Speaker 3

Exactly.

Speaker 1

Dean, coming back to you, we've also mentioned the corporate reporting project. We don't have a lot of detail about what that is, but it does look as if what it's trying to do is reduce the volume of corporate reporting.

Speaker 4

Yeah. I mean, presented to the public as part of the government's sort of reducing business burdens agenda. And I think there are a lot of opportunities there to reduce burdens on business through looking at, you know, what needs to be in the annual report and accounts.

The risk here though is that you potentially lose decision critical, decision important information from the reports. But equally, see it as a great opportunity to maybe help reports to be presented in a way that is more useful.

We did a survey last year. We published an annual kind of barometer on audit trust called the audit trust index. And some of the questions we ask audit committee chairs, investors and FTSE three fifty FDs is around the sort of clarity of reporting. And you know generally there's demand that reports are clearer and this is an opportunity for government to you know look quite holistically across reporting framework and say actually can reports be better but maybe more straightforward, simpler, cut out things that are costly to produce and not value adding to stakeholders. So I think it's a real opportunity to look at this but the proof will be in the extent to which the consultation is focusing on a few areas maybe or whether it's more open.

Speaker 1

We'll have to wait for the detail on that. And let me take you back to the other thing the government has promised which is to place the regulator financial reporting council or the audit reporting and governance authority. We don't know what it's gonna be called yet. But anyway, they're gonna place it on a statutory footing.

Could that be an opportunity to revisit some of the things we think are currently lost such as powers in some way?

Speaker 3

I think absolutely.

It's a perfect opportunity to do that.

It depends what powers they're given and how far they can go with that. But I think that some of the things may be able to be picked up.

Of the things that we've lost may be able to be picked up by them under their new guys, because they now have, or they then will have, the power to insist on these things rather than just saying this is good guidance'. So I think it's an absolutely prime opportunity to do this. My concern is that we don't know when this is going to happen. It's still when parliamentary time permits.

Speaker 4

If I could come in on that, Yes,

Speaker 1

Yes, please.

Speaker 4

I mean, I look very carefully at the language that the government was using around this.

And I think it would be, I wouldn't necessarily jump to the conclusion that this means that, you know, we will see ARGAP, we will see all of the powers that have been talked about. In its most basic form it is about putting what is a kind of standard setting body with some delegated powers, you know setting it up as a statutory regulator and giving it that you know that having powers clearly set out in legislation. And I think it's an extension then to think about well actually will this mean that it will get powers to investigate all directors, you know a range of civil sanctioning powers.

I'm not sure. I think we could see something which is much more of a kind of practical you know change to the nature of the regulator without necessarily going into some of those more challenging policy areas. But I could be wrong you know and we would definitely as I mentioned earlier you know the powers overall directors to hold them to accountable I think is a missing piece in the regulatory framework. So if it doesn't come through whatever legislation they use to put the FRC in a statutory footing, I hope it's something that will still come later down the line.

Speaker 1

Okay. Let me ask you about that then, turn to you, Anne. What is your hope that if the piece of legislation for statutory footing, if that's not used in this way, what is the hope that any of these issues come back in the future? Or are we waving goodbye to them for good?

Speaker 3

I don't think we are waving goodbye for good because I think if we don't get these things through, there will be another carillion come along at some point.

And at that point, there'll be outrage in how has this happened and it will get revisited. I think that's just the way it is. I think we were talking earlier about, you people forget, you soon forget something that's happened, but when it happens again and it happens again, you suddenly go, this seems to be keeping on happening. So how are we going to fix this? I think it will come at some point.

I hope sooner rather than later so that we don't end up with another Karelian.

But I fear that may be what happens.

Speaker 1

Dean, the test for the current government's decision is always going to be the next corporate scandal. I wonder, and many investors will be thinking, are investments in the UK safer as a result of this decision, the current decision to end the reform process apart from what we know is underway?

Speaker 4

I mean, I think I think they're safer just based on, you know, what has happened since twenty eighteen, you know, and there have been lots of small iterative changes in the UK that have been positive.

What we've lacked is that one big sort of comprehensive consolidated hit of an audit reform and corporate governance bill. But that's not to say that some of the important aspects of that won't still be delivered but they may be delivered in a different way.

I think the biggest downside for me of this is that you still end up with kind of a little bit of a patchwork. So you know the UK corporate governance code doesn't cover all public interest entities even and you still have differences between how large systemically important private companies are regulated and what they have to report compared to listed companies and other public interest entities have to report. So I think those are some of the negatives. But I do think that even looking at some of the policy changes that would still be welcomed, I think the final shape of those policies should be forward looking and not backwards looking because I think the world has moved on significantly in the last eight years.

And technology has played a large part in that too in terms of sort of transparency around company data. And I think that's one area that's only going to exponentially change as well going forwards. And the policies that you make now need to be fit for two thousand and thirty, not for twenty eighteen.

Speaker 1

And the same question to you. Are investments safer in the UK as a result of this decision?

Speaker 3

I don't think they are.

I think they're safer than they were in twenty eighteen, but they're not as safe as they could be. And I think that's my concern with this not going through is the knock on effect it will have with investor confidence.

I agree with Dean in that we could see some of these things coming through in a different way, it doesn't need to be a big bang of an audit reform bill. If it comes in in different ways, that's great.

We're not looking for a big bill.

We're looking for positive changes, but regulatory positive changes that will make it safer for investors.

I think it's got to come.

And as I said, I think sooner rather than later, simply because people will go, is the UK really somewhere you want to invest?

Speaker 1

We've come to the end of our time. Before we go, can I just get from both of you one item, one reform item you think the government should put into action tomorrow? Let me start with you Dean. What's your one item you think we should sort out?

Speaker 4

I do think that the having a regulatory framework that proportionately holds boards to account for their responsibilities you know in financial reporting is really important. And at the moment you know there are gaps there and the bill would definitely sort of gone to address some of those gaps.

Speaker 1

Anne, your one action point for the government tomorrow morning.

Speaker 3

Yeah, crack on with creating a proper regulator with the powers to regulate.

Speaker 1

Dean Beale and Kym, thanks very much for joining us on this edition of Governance Watch. And thanks to all of you for downloading and listening in. I've been Gavin Hinks. Goodbye.

Speaker 2

That was Governance Watch, brought to you by Board Agenda, your hub for expert insights, governance intelligence, and boardroom thinking.

To access thousands of articles, reports, guides and our upcoming events, sign up or log in at boardagenda dot com. That's boardagenda dot com.