The Financial Reporting Council (FRC) has revised two standards to address changes in the International Code of Ethics for Professional Accountants. This revision introduces explicit ethical requirements for auditors using external consultants in audit, assurance, and non-assurance engagements. This update addresses a control gap as audit firms increasingly rely on third-party specialists for tasks like IT security assessments and valuation work.
Timeline
The International Ethics Standards Board for Accountants (IESBA) Code evolved to include specific provisions on external consultant use. The FRC revised its auditing and assurance standards to align with the International Auditing and Assurance Standards Board (IAASB) standards. The revised UK standards now incorporate these explicit ethical requirements.
Which Controls Failed or Were Missing
Before this revision, the ethical framework for using external consultants in audit engagements lacked explicit requirements. Audit firms operated under general independence and competence principles, but the standards didn't specify how to assess and manage ethical risks when involving third-party expertise.
Three control gaps existed:
Independence screening for consultant relationships. Engaging a consultant who has worked for your audit client in another capacity introduces a potential independence threat. The previous framework didn't require systematic screening of these relationships before engagement.
Competence verification procedures. Auditors relied on consultants' credentials without a structured process for verifying that the specialist's expertise matched the specific engagement requirements. A cybersecurity consultant qualified to assess network architecture might lack the expertise to evaluate AI system controls, but the standards didn't mandate this granular competence assessment.
Work product review protocols. The framework lacked explicit requirements for how auditors should review and take responsibility for consultant work. Some firms treated consultant reports as standalone outputs rather than inputs requiring professional judgment and verification.
What the Relevant Standards Require
The IESBA Code now establishes specific ethical requirements across three dimensions:
Threats and safeguards framework. Section 120.6 of the IESBA Code requires auditors to identify and evaluate threats to compliance with fundamental principles when using external consultants. This includes self-interest threats (if the consultant has a financial interest in the outcome), familiarity threats (if the consultant has prior relationships with the client), and advocacy threats (if the consultant's work could be seen as advocating for the client's position).
Competence and capabilities assessment. The standards require auditors to evaluate whether the external consultant possesses the necessary competence, capabilities, and objectivity for the specific engagement. This isn't a one-time credential check. You're required to assess whether the consultant's experience matches the complexity and nature of the work you're delegating.
Professional accountability. The revised standards clarify that auditors remain professionally responsible for the work performed by external consultants. You can't outsource judgment. When you incorporate a consultant's findings into your audit opinion, you're required to apply professional skepticism to their work and ensure it meets the same quality standards you'd apply to work performed by your own team.
The FRC's alignment with these requirements means UK audit firms must now implement controls that were previously discretionary.
Lessons and Action Items for Your Team
If you're responsible for audit quality or engagement management, here's what needs to change:
Build a consultant vetting protocol. Create a structured process for evaluating external consultants before engagement. This should include independence questionnaires that specifically ask about prior work for the audit client, financial interests in the client or related entities, and personal relationships with client management. Don't rely on general conflict-of-interest statements. Ask specific questions tied to the engagement scope.
Document competence assessments. For each consultant engagement, document why you've determined the individual or firm possesses the necessary expertise. Include their relevant qualifications, prior experience with similar work, and any limitations you've identified. If you're engaging a valuation specialist, your documentation should show you've verified their experience with the specific valuation methodology required, not just general valuation credentials.
Establish work product review procedures. Define what "taking responsibility" for consultant work means in practice. This should include reviewing the consultant's methodology, testing key assumptions, and documenting how you've evaluated the reasonableness of their conclusions. If you can't explain the consultant's approach well enough to defend it to a regulator, you haven't adequately reviewed their work.
Update engagement letters. Revise your standard engagement terms to explicitly address the consultant's obligations regarding independence, objectivity, and documentation. Include requirements for the consultant to notify you immediately if circumstances change that could affect their independence or objectivity during the engagement.
Train engagement teams. Your audit teams need to understand they can't treat consultant reports as black boxes. Provide training on how to apply professional skepticism to specialist work, what questions to ask when reviewing consultant methodologies, and how to identify situations where additional verification is required.
Review existing consultant relationships. Conduct a retrospective assessment of consultants you've used in recent engagements. Identify any relationships that wouldn't meet the new explicit requirements and determine whether you need to modify or terminate those arrangements.
The FRC's revision reflects a broader regulatory trend toward making implicit expectations explicit. The fundamental principles haven't changed, but the controls you're expected to implement have become more specific and demanding. If your firm's approach to external consultants has been informal or relationship-based, that approach no longer meets the standard.
