Briefing / External audit reports: the role of the audit committee
This short paper is intended to support audit committee members to easily understand the range of external audit reports and additional powers.
In the context of ongoing operational and financial pressures in the NHS, the need for strong financial and governance arrangements is particularly important. Auditors provide a key source of information to audit committee members, and the public, in determining and reporting on the financial statements, VFM arrangements and other matters.
The audit committee has a crucial role in scrutinising these arrangements. Committee members must ensure that they fully understand external audit reports so that they are in a position to effectively scrutinise and challenge actions being taken to address issues being raised.
Introduction
This paper aims to support audit committee members to scrutinise and challenge the effectiveness of their organisations’ arrangements to manage finances and secure value for money (VFM).
With ongoing operational and financial pressures in the NHS, the need for strong financial and governance arrangements is particularly important. The audit committee has a crucial role in scrutinising these arrangements. Auditors provide a key independent source of information for audit committee members, and the public, in determining and reporting on the financial statements, VFM arrangements and other matters.
As recommended in the NAO report
By providing an overview of external auditor reports and auditors’ additional powers and duties, this short paper is a helpful reference guide to support audit committee members as they consider external audit reports. Further detail on external audit and the role of the audit committee is provided in chapter 10 of HFMA’s NHS audit committee handbook
Responsibilities of audit committees
There is a statutory requirement for every NHS organisation to have an audit committee, as set out in HM Treasury's guidance
The audit committee performs a crucial role in the governance of NHS organisations, with members responsible for scrutinising the risks and controls affecting the business. As set out in HFMA's NHS audit committee handbook
There are a number of documents produced by NHS organisations setting out how they have managed their resources – a key one being the annual report and accounts. This presents the story of the organisation’s activities during the previous financial year. The accounts present the financial position and performance while the annual report sets out what the organisation has done, and is doing, in order to meet its objectives and to demonstrate that it is adding value to its members, patients, public and other stakeholders.
The form and content of the annual report and accounts must meet specific requirements – these are set out in the Department of Health and Social Care’s (DHSC’s) Group accounting manual (GAM)
The annual report and accounts includes the governance statement. This focuses on the stewardship of the organisation and draws together evidence on governance, risk management and control. It sets out how the accounting officer discharged their responsibility to maintain a sound system of internal control, explaining how the board, audit committee and other board committee responsibilities work, as well as declaring significant internal control issues affecting the organisation.
The audit committee is required to review the draft annual report and accounts before it is submitted to the board for scrutiny and approval. Audit committees are encouraged to review the financial position and governance issues throughout the year, as well as the year-end. Further guidance is provided in the HFMA briefings, How to review and scrutinise the numbers during the year
Auditors’ responsibilities
Auditors are central to the audit committee’s role as they provide both assurance and insight into the management arrangements within the organisation. Throughout the year internal and external audit provide a number of reports, which audit committee members can draw from. This briefing focuses on those provided by external audit.
The Local Audit and Accountability Act 2014 (the Act)
As well as complying with the Code, auditors also have to meet the requirements of the International Standards on Auditing (ISAs)
The audit plan covers both the work on the audit of the financial statements and arrangements to secure VFM. It sets out the auditor’s view of significant risks at the start of the year. It should facilitate timely discussions between the auditor, management and TCWG. The auditor will keep the audit plan under review, providing updates throughout the year, and therefore support committee members to provide ongoing scrutiny and challenge.
The report to those charged with governance (the ISA 260 report) sets out findings from external audit work and aims to ensure that TCWG are aware of, and have considered, any issues arising from the audit before approving and adopting the annual report and accounts. There is no requirement to publish this report - it is up to the local organisation to determine whether it wishes to publish its audit committee papers, including the report to TCWG.
The auditor will ask TCWG to review a letter of representation signed by the accountable officer. In some cases, the chair of the audit committee will also sign the letter representing TCWG. This is a formal letter to the auditors covering matters the auditors want confirmation on such as:
• areas where TCWG or management have had to make a judgement
• that the representations made by management are accurate and reasonable
• that TCWG agree that errors identified by the auditors should be adjusted or left unadjusted.
The auditor’s annual report (AAR) also sets out the audit findings. This replaces the annual audit letter previously required by the Code and should be issued at the same time as the opinion on the financial statements for local NHS bodies. With the removal of previous special reporting provisions relating to value for money (VFM) arrangements, introduced during the Covid-19 pandemic, auditors will be required to complete their work on VFM in time to report significant weaknesses in arrangements in the opinion on the financial statements. Where auditors are unable to complete their work to satisfy themselves as to whether there are significant weaknesses in VFM arrangements, they will not be able to issue their opinion on the financial statements until they have completed their work.
The AAR is a public document and must be made available to members of the public free of charge – published on the body’s website. The AAR includes: a summary of the work on the accounts opinion; commentary on VFM arrangements work; recommendations and follow up; and details of any other powers exercised such as the issuing of a public interest report.
The audit completion certificate ‘closes’ the audit for the audit period covered, confirming that the audit has been completed in accordance with the Code and marking the point when the auditor’s responsibilities have been discharged. The auditor should not certify completion until all of their planned work is complete. NHS foundation trusts can only lay their annual report and accounts once the audit report (opinion) is accompanied by the audit certificate. All NHS bodies need to include the audit certificate in their annual report and accounts, therefore cannot publish them without this.
External audit reports
At the completion of the audit, the auditor will issue an audit report covering the areas as set out in more detail in the sections below. Where auditors are not satisfied that financial statements give a true and fair view, they issue a non-standard audit report. A non-standard audit report may also be issued where the auditor decides to draw attention to a matter that they consider readers of the financial statements should be aware of. Under the 2020 Code, where auditors identify a significant weakness in the body’s arrangements to secure VFM, they report this matter by exception and raise a recommendation in relation to the issue(s).
‘Materiality’ and ‘significance’ are key terms referred to in external audit reports. An item is considered to be material if, individually or in aggregate, it could reasonably be expected to influence the economic decisions of users, if those decisions are made based on the contents of the financial statements. Materiality is based on the auditor’s professional judgement which will take into account the size and nature of the items, as well as surrounding circumstances.
As set out in the Code
Opinion on the financial statements
Auditors give an opinion on whether the financial statements are prepared properly, free from material error and give a ‘true and fair’ view of the organisation’s financial position. The opinion is qualified if the auditor disagrees with an item’s accounting treatment or has been unable to obtain sufficient supporting evidence. An unqualified opinion is often called a clean opinion.
There are different types of qualified opinions depending on the impact of the issue in question on the financial statements. Qualifications can be issued as ‘except for opinion’ based on limitation of scope or disagreement; an ‘adverse opinion’ or a ‘disclaimer of opinion’.
In giving the opinion, an emphasis of matter is used when auditors need to draw attention to a particular aspect of the accounts, but which does not affect their true and fair opinion.
Auditors report any going concern issues as a material uncertainty relating to going concern i.e. whether it can reasonably expect to continue to function for the foreseeable future (usually at least 12 months). As per the practice note for the audit of financial statements in the public sector (PN10)
Management should refer to the GAM
Opinion on regularity (ICBs only)
Auditors give an opinion on whether or not an ICB’s income and expenditure is in accordance with laws and regulations. The regularity opinion is qualified if an ICB overspends against its financial spending limit or incurs unlawful expenditure. If the regularity opinion is qualified, the governance statement and the accountable officer’s statement should also refer to the issue that caused this.
Auditor’s work on value for money (VFM) arrangements
The 2020 Code included a significant change in the way auditors were expected to approach and report their work on VFM arrangements. A VFM commentary replaces the binary VFM conclusion. It covers financial sustainability, governance and improving economy, efficiency and effectiveness. There is also the requirement to make a recommendation where significant weaknesses are identified. AGN 03
The audit report on the financial statements will only include reference to the VFM work where the auditor has identified a significant weakness. The auditor’s annual report will include the auditor’s commentary.
External audit additional reporting powers
External auditors also have a range of statutory powers to issue reports or recommendations that require NHS organisations to publicly consider the matters reported to them and publish their response, as set out below. These additional powers are important tools for the auditor and enable him/ her to bring attention to issues and ensure prompt action.
Public interest report
(Section 24, Schedule 7(1)(1) Local Audit and Accountability Act 2014) for NHS trusts and ICBs and Schedule 10(3) National Health Service Act 2006 for foundation trusts)
Addressed to the public, a public interest report is issued when the external auditor considers there is a matter which they need to draw explicitly to the public’s attention. They can be published at any time. The public interest report imposes additional requirements on the organisation, including holding a public meeting to consider the report and publishing a formal response. Public interest reports can be made at any time throughout the year.
Statutory recommendation (not applicable to foundation trusts)
(Section 24, Schedule 7(2) Local Audit and Accountability Act 2014)
Addressed to the NHS body, a statutory recommendation is issued when the external auditor needs to make a formal recommendation to take action. The action required will be about issues such as failing to deliver planned cost savings or failure to address weaknesses highlighted by independent reviews. Recommendations require formal, public consideration and response. They are often referred to as Schedule 7 recommendations. A statutory recommendation can be made at any time during the year.
Section 30 referral (not applicable to foundation trusts)
(Section 30 Local Audit and Accountability Act 2014)
Addressed to the Secretary of State, the auditor is legally required to make a section 30 referral where the organisation is about to, or has entered into, a transaction that the auditor believes is unlawful. For example, an ICB exceeding its expenditure limit or an NHS trust failing to meet the break-even duty.
Schedule 10 referral (only applicable to foundation trusts)
(Schedule 10(6) National Health Service Act 2006)
Addressed to the regulator, a section 10 referral is legally required when an NHS foundation trust is about to make a decision or enter into a transaction that the auditor believes would be unlawful.
NAO guidance
Auditors follow an integrated audit approach. What they find in one part of the audit will inform the different elements of the audit report. There are links between additional reporting powers and the opinions given by the auditor. For example, if an ICB breaches its expenditure limits, it will be referred to the Secretary of State as a section 30 referral and receive a qualified regularity opinion. It will also be considered as part of the auditor’s work on VFM arrangements.
Acting on audit reports
A non-standard report from the external auditor is a public, independent warning sign that that must be taken seriously and acted upon. This is an important role of the audit committee in the stewardship of taxpayers’ funds. This is echoed in the findings and recommendations of the NAO report on local auditor reporting
The requirements for the approach and reporting of VFM work, including clear recommendations, will provide valuable commentary for organisations to discuss and act on.
Where issues are communicated by auditors - during the year for example through audit planning reports, as part of a qualification or by audit recommendations - audit committee members must ask themselves whether they are providing appropriate challenge on actions taken by the organisation to address the issues. To do this, they need to:
a) understand the audit risks and qualification and consider whether it is consistent with their understanding of the organisation
b) review current and proposed actions being taken to address the issue(s)
c) follow up and challenge on an ongoing basis whether agreed actions are being undertaken and are sufficient.
Audit committee members have an important role in seeking assurances and providing challenge on plans, they should also understand how their organisation fits into the wider system position. Auditors only report on individual statutory bodies, therefore it is important that the audit committee looks at how it is getting assurance in areas not covered by local audit, such as how partnerships are held to account for joint decisions.
Conclusion
Audit committees have a number of key responsibilities and to ensure these are fulfilled effectively, members need to make use of all sources of information available, including reports from management and auditors.
This paper explains the different audit reports and how they relate to each other. Committee members must ensure that they have the time and skills to fully understand audit reports so that they are in a position to scrutinise and challenge actions being taken to address issues the being raised. Although a number of key reports are provided at the year-end, issues being raised at that point should not be a surprise. The audit committee also has an important role in ensuring that issues regarding the body are reported in a transparent way.
Recognising the significant change and challenges faced by the NHS today, the audit committee role to oversee strong financial and governance arrangements is as vital as ever.
Related content
Overall the HFMA agrees with the proposed framework changes, although there are a number of areas that would benefit from further detail.
NHS bodies’ audit reports have been qualified due to failures to meet the requirements of Managing public money.