What ICAEW monitoring found in accountancy practices in 2025

General information for practice owners, accurate as at 24 August 2026. All monitoring figures are as published by ICAEW in A Framework for Good Practice: Practice Assurance Monitoring Report 2026, which reports on reviews carried out during 2025. Rules and regulations change — take your own advice before acting.

Each year ICAEW publishes a report setting out, in detail, what its inspectors found across all the firms they reviewed. The findings are ranked by how often they occur, so the report shows a practice owner where an inspector is likely to look first and what is most often written up.

The 2026 edition, A Framework for Good Practice, covers more than 2,000 Practice Assurance monitoring reviews carried out during 2025. To be precise, ICAEW conducted 1,715 separate reviews covering 2,068 firms, up sharply from 1,185 reviews covering 1,489 firms the year before. It aims to reach every firm at least once every eight years, and more often where risk factors — size, complexity, previous review history, or its own risk monitoring — suggest it should.

At 88% of the firms reviewed, ICAEW either raised no matters requiring action or the firm fixed what was raised with no follow-up needed. The enforcement figures all rose, and the list of what inspectors found is almost identical to last year’s list. The same six or seven areas appear each year, in much the same order.

The 2025 findings table

ICAEW publishes a ranked table of every area where at least one finding of non-compliance was recorded. More than one area can apply to a single firm, so the numbers overlap. Each percentage is of reviews and visits.

The order of the table tells you more than the individual numbers. The top four areas are AML record-keeping, telling clients how you charge, keeping your own record at ICAEW accurate, and running a client bank account in line with the Clients’ Money Regulations. None of them requires specialist expertise. Each needs someone in the firm to own the task and do it every year.

Enforcement in 2025

The 88% figure is stable. Enforcement action increased. In 2025 the Practice Assurance Committee considered 81 visit reports, against 45 in 2024. It issued penalties of up to £10,000 to 44 firms, against 25 the year before, and referred 37 firms to ICAEW’s Conduct Department for further investigation, against 23. Review volumes rose by around 39%; committee reports rose by 80% and penalties by 76%.

ICAEW lists the reasons firms were reported to the committee:

• 34 firms had significant weaknesses in complying with the Money Laundering Regulations — and ICAEW notes that some had failed to fulfil assurances given at the previous review. In some cases they also failed to comply with the Clients’ Money Regulations.
• 28 firms were using the description ‘Chartered Accountants’ when they were not eligible to do so.
• 19 firms had significant breaches of the Clients’ Money Regulations.
• 6 firms had not notified clients of commission received, or had not obtained consent to retain it.
• 4 firms had significant gaps in their professional indemnity insurance.

ICAEW states that failure to address issues raised at the previous review is a common reason for firms being reported to the committee. A finding closed promptly usually takes an afternoon of work. A finding still open at the next visit can lead to a committee report and a penalty, because by then it shows how the firm is managed.

Clients’ money findings

Clients’ money fell from second to fourth place in the rankings. It still accounted for 19 of the firms reported to the committee for significant breaches. ICAEW sets out what it found:

• 109 firms had no bank trust letter acknowledging the status of the clients’ money bank account.
• 63 firms had not carried out and documented an adequate annual clients’ money compliance review.
• 47 firms were not using designated clients’ money accounts when holding £10,000 or more for more than 30 days.
• 41 firms were handling or holding client money unrelated to the accountancy services they were providing.
• 33 firms had taken their fee from a client money balance without the client’s consent, or without waiting at least 30 days after issuing the invoice.
• 26 firms had not reconciled clients’ money accounts at least once every five weeks.

Each of those is a routine control with a date attached. A trust letter is a single request to your bank. A five-weekly reconciliation is a recurring diary entry. An annual compliance review is a checklist ICAEW publishes for you. In a small firm the person responsible for these controls is often also doing chargeable work in January, and a control can lapse during the busy months.

Fees, complaints and engagement letters

The second-placed finding covers the basis of fees, complaints procedures and engagement letters. ICAEW found 273 firms that had not told clients, in writing, one or both of: the basis on which fees are charged, and the firm’s complaints procedure including the client’s right to complain to ICAEW.

ICAEW also states that you do not have to issue engagement letters. The two matters must be communicated in writing, and a standard terms of business letter, a brochure, or a paragraph in the initial correspondence is acceptable. The requirement is that the client receives both pieces of information in writing.

Separately, inspectors found engagement letters that were not kept up to date, did not cover specialist services, and in some cases told clients the firm could carry out work requiring a DPB (Investment Business) licence when it could not. ICAEW has issued updated engagement letter templates with new schedules reflecting recent regulatory, operational and technological developments. If your standard letter is more than two years old, compare it with the new templates.

Third place goes to errors in firms’ annual return data and ICAEW records, at 17% of reviews. One rule in this area: you must notify ICAEW of any change to the structure of your firm within 10 business days, and using the annual return to do it is itself a breach of the Practice Assurance Regulations. If you have taken on a partner, changed ownership, closed an office or changed a trading name and waited until return season to tell ICAEW, that is a breach under this heading.

Professional indemnity insurance, referrals and commissions

Professional indemnity insurance produced 125 findings, mostly firms inadequately insured or holding a policy that did not comply with ICAEW’s PII Regulations, plus notifications not made to insurers and errors on proposal forms. The revised PII Regulations took effect on 1 September 2024, and the requirements are specific: cover with a participating insurer meeting ICAEW’s minimum policy wording; a minimum limit of indemnity of £2m for any single claim and in the aggregate; for firms with gross fee income below £800,000, two-and-a-half times gross fee income subject to a floor of £250,000 per claim and in aggregate; and a maximum aggregate excess of the higher of £3,000 or 3% of gross fee income. Firms above £50m of gross fee income are not required to hold qualifying insurance but must have appropriate arrangements, which ICAEW monitors.

Referrals and commissions produced 158 findings — typically firms that had not told clients in writing how much commission they received, or had not obtained consent to retain it. The Code of Ethics 2025, which took effect on 1 July 2025, requires all three steps: notify in writing, obtain written consent, and treat the amount as clients’ money in a client account until you have permission to keep it. Advance informed consent through your engagement letter is permitted for unregulated activities, but you still have to tell the client the actual amount once received.

A related boundary issue caught 92 firms: referrals to restricted advisers, or referrals where the adviser’s status was not known. If you refer clients to a financial adviser, you are expected to know whether that adviser is independent or restricted, and to assess whether a restricted adviser can meet your client’s needs. If you are not confident making that assessment, ICAEW’s position is that you should refer only to independent advisers. In data protection, the main finding was five firms that had not registered with the Information Commissioner’s Office.

Cyber security at larger firms

Each year ICAEW picks an area of focus and discusses it in depth with larger firms. For 2025 it was cyber security, and it spoke to 121 larger firms. In their own assessment, 99% of respondent firms felt they had good awareness of cyber threats and robust procedures, and 99% knew about the Cyber Essentials scheme.

The recorded controls were lower. 54% had completed the Cyber Essentials basic self-assessment and 29% Cyber Essentials Plus. Only 45% included cyber security risk in their organisational risk register. Just 32% had exercised a right to audit suppliers or require upward reporting, and only 25% had minimum supplier security requirements written into contracts. 73% held specific cyber insurance cover.

16% of respondent firms had suffered a cyber-attack, though not all resulted in a data breach. The incidents ICAEW describes were attempts to intercept payment instructions, compromised shared mailbox access, email account access through phishing, and ransomware. Of the firms attacked, 84% reported the incident to bodies such as the NCSC, ICO, HMRC or ICAEW, and 74% told affected clients or suppliers.

ICAEW’s recommendations are about governance: assign cyber risk to a senior business leader, put it in the risk register, write an incident response plan and test it at least annually, run supplier risk assessments, and set controls over data exchange. Overall responsibility for cyber security sat with a non-specialist practice principal at 57% of respondent firms.

What ICAEW is looking at in 2026

Two areas of focus are named for 2026, and both will be discussed with larger firms during this year’s monitoring:

• Professional Conduct in Relation to Taxation (PCRT). The current version took effect on 1 January 2026. It applies to all members advising on UK tax, including employees of those members, and to members’ own tax affairs. The latest edition responds to government pressure on the professional bodies to lead more firmly on standards around the facilitation and promotion of tax avoidance, and the PCRT bodies have a working group drafting topical guidance on how PCRT applies to Making Tax Digital.
• Working with vulnerable clients. This is a newer theme in practice monitoring. A firm can handle vulnerable clients with care and still have no written policy for doing so.

If your firm is large enough to get the focus-area conversation, the discussion will be about written policies and procedures. Be ready to show how the firm applies the PCRT standards to its tax planning work, with examples from client files.

How a buyer uses your monitoring letter

If you are planning a sale or succession, a buyer will ask for your last monitoring letter early. It is an independent assessment of how the firm is run, written by ICAEW, and it carries more weight with a buyer than documents the firm prepared itself. Our guide to due diligence when selling your practice covers the other documents a buyer asks for.

A clean letter shortens due diligence and settles questions about compliance early. An open finding slows the process, widens the warranty and indemnity schedule, and moves more of the consideration into deferral while the buyer satisfies itself the file is clean. We cover other avoidable losses of value in what reduces the value of your practice.

A repeat finding costs the most. When a buyer reads “this was raised at the previous review”, they treat it as evidence about governance and price in the risk that other controls have lapsed too. AML supervision is also changing: we covered the shift to a single FCA AML supervisor and the rulebook changes that landed on 30 June 2026. AML was the most frequent monitoring finding in 2025, and supervision of it is moving to the FCA.

Your pre-visit self-review

You can run this self-review yourself in an afternoon, using ICAEW’s published list of findings. Work through it in this order, which broadly follows how often each finding occurs.

• Re-read your last monitoring letter. Check that every point on it is closed, with a date and evidence. Unresolved points from a previous review are a common reason for a committee report.
• Date-stamp your firm-wide AML risk assessment. If it has not been reviewed in the last twelve months, update it. AML breaches appeared in 63% of reviews in 2025.
• Open your standard terms of business. Does it state the basis of fees and the complaints procedure including the right to complain to ICAEW? Does it still describe services you no longer provide, or claim a DPB licence you do not hold?
• Check your ICAEW record. Confirm that principals, offices, trading names, ownership and regulatory contacts are correct, and that any structural change in the last year was notified within 10 business days and not via the annual return.
• Confirm your eligibility to use ‘Chartered Accountants’. In 2025, 28 firms used the description without being eligible. Check your eligibility again after any structural change.
• If you hold client money: trust letter on file, five-weekly reconciliations evidenced, designated accounts for £10,000-plus held over 30 days, annual compliance review documented, no fees taken without consent or before 30 days.
• Check PII against the September 2024 rules. Participating insurer, £2m minimum limit, the 2.5× gross fee income test if you are under £800,000, and your excess against the £3,000-or-3% cap.
• Commissions: written notification of amounts received, written consent to retain, and adviser status known before you refer.
• Cyber: is cyber risk named in a risk register with a named senior owner, and has the incident response plan been tested in the last twelve months?

A monitoring visit goes most smoothly when the compliance manual matches what the client files show, and when the findings from the last visit have been closed with evidence. Both are cheapest to put right before a visit is booked.