What ICAEW Monitoring Actually Finds Inside Practices Like Yours

General information for practice owners, accurate as at 24 August 2026. All monitoring figures are as published by ICAEW in A Framework for Good Practice: Practice Assurance Monitoring Report 2026, which reports on reviews carried out during 2025. Rules and regulations change — take your own advice before acting.

Most practice owners treat a monitoring visit as weather. It arrives, you get through it, you file the letter. What almost nobody does is read the report ICAEW publishes afterwards setting out, in detail, exactly what its inspectors found across the whole population of firms — which is odd, because it is effectively a leaked exam paper.

The 2026 edition, A Framework for Good Practice, covers more than 2,000 Practice Assurance monitoring reviews carried out during 2025. To be precise, ICAEW conducted 1,715 separate reviews covering 2,068 firms, up sharply from 1,185 reviews covering 1,489 firms the year before. It aims to reach every firm at least once every eight years, and more often where risk factors — size, complexity, previous review history, or its own risk monitoring — suggest it should.

The headline is reassuring and the detail is not. At 88% of the firms reviewed, ICAEW either raised no matters requiring action or the firm fixed what was raised with no follow-up needed. But underneath that, the enforcement numbers moved hard in one direction, and the list of what inspectors keep finding is almost identical to last year's list. These are not exotic failures. They are the same six or seven things, in the same order, year after year.

The findings league table — and why the order matters

ICAEW publishes a ranked table of every area where at least one finding of non-compliance was recorded. More than one area can apply to a single firm, so the numbers overlap. This is the table, with the percentage expressed against reviews and visits.

Read the order rather than the individual numbers. The top four are not technical judgement calls about complex work. They are AML housekeeping, telling clients how you charge, keeping your own record at ICAEW accurate, and running a client bank account properly. None of them requires specialist expertise. All of them require someone in the firm to own the task and actually do it every year.

Enforcement is the part that changed

The 88% figure is stable and comfortable. The tail is not. In 2025 the Practice Assurance Committee considered 81 visit reports, against 45 in 2024. It issued penalties of up to £10,000 to 44 firms, against 25 the year before, and referred 37 firms to ICAEW’s Conduct Department for further investigation, against 23. Review volumes rose by around 39%; committee reports rose by 80% and penalties by 76%.

The reasons ICAEW lists for those reports are worth reading as a list of things that get you escalated rather than corrected:

• 34 firms had significant weaknesses in complying with the Money Laundering Regulations — and ICAEW notes that some had failed to fulfil assurances given at the previous review. In some cases they also failed to comply with the Clients’ Money Regulations.
• 28 firms were using the description ‘Chartered Accountants’ when they were not eligible to do so.
• 19 firms had significant breaches of the Clients’ Money Regulations.
• 6 firms had not notified clients of commission received, or had not obtained consent to retain it.
• 4 firms had significant gaps in their professional indemnity insurance.

ICAEW is unusually direct about the pattern: failure to address issues raised at the previous review is a common reason for firms being reported to the committee. That is the single most useful sentence in the document. An ordinary finding, closed, costs you an afternoon. The same finding, still open at the next visit, is what turns into a penalty — because by then it is evidence about how the firm is run, not about a form.

Clients’ money: small firms, real breaches

Clients’ money slipped from second to fourth place in the rankings, but it remains the area most likely to produce a serious finding relative to how few firms it affects. ICAEW sets out exactly what it found:

• 109 firms had no bank trust letter acknowledging the status of the clients’ money bank account.
• 63 firms had not carried out and documented an adequate annual clients’ money compliance review.
• 47 firms were not using designated clients’ money accounts when holding £10,000 or more for more than 30 days.
• 41 firms were handling or holding client money unrelated to the accountancy services they were providing.
• 33 firms had taken their fee from a client money balance without the client’s consent, or without waiting at least 30 days after issuing the invoice.
• 26 firms had not reconciled clients’ money accounts at least once every five weeks.

Every one of those is a mechanical control with a date attached. A trust letter is a single request to your bank. A five-weekly reconciliation is a recurring diary entry. An annual compliance review is a checklist ICAEW publishes for you. The reason these keep appearing is not difficulty — it is that in a small firm the person responsible is usually also the person doing chargeable work in January, and the control quietly lapses.

The paperwork you thought was optional

Second place in the table surprises people, because most owners assume it is about engagement letters and most owners have engagement letters. It is not quite that. ICAEW found 273 firms that had not told clients, in writing, one or both of: the basis on which fees are charged, and the firm’s complaints procedure including the client’s right to complain to ICAEW.

ICAEW then says something firms rarely notice: you do not have to issue engagement letters at all. Those two matters must be communicated in writing, but a standard terms of business letter, a brochure, or a paragraph in the initial correspondence will do. The finding is about the message, not the format.

Separately, inspectors found engagement letters that were not kept up to date, did not cover specialist services, and in some cases told clients the firm could carry out work requiring a DPB (Investment Business) licence when it could not. ICAEW has issued updated engagement letter templates with new schedules reflecting recent regulatory, operational and technological developments — which, if your standard letter predates the last two years of change, is your cue.

Third place is even more prosaic: errors in firms’ annual return data and ICAEW records, at 17% of reviews. One rule inside that finding catches firms repeatedly — you must notify ICAEW of any change to the structure of your firm within 10 business days, and using the annual return to do it is itself a breach of the Practice Assurance Regulations. If you have taken on a partner, changed ownership, closed an office or changed a trading name and told nobody until return season, that is the finding.

PII, referrals and the boundary problems

Professional indemnity insurance produced 125 findings, mostly firms inadequately insured or holding a policy that did not comply with ICAEW’s PII Regulations, plus notifications not made to insurers and errors on proposal forms. The revised PII Regulations took effect on 1 September 2024, and the requirements are specific: cover with a participating insurer meeting ICAEW’s minimum policy wording; a minimum limit of indemnity of £2m for any single claim and in the aggregate; for firms with gross fee income below £800,000, two-and-a-half times gross fee income subject to a floor of £250,000 per claim and in aggregate; and a maximum aggregate excess of the higher of £3,000 or 3% of gross fee income. Firms above £50m of gross fee income are not required to hold qualifying insurance but must have appropriate arrangements, which ICAEW monitors.

Referrals and commissions produced 158 findings — typically firms that had not told clients in writing how much commission they received, or had not obtained consent to retain it. The Code of Ethics 2025, which took effect on 1 July 2025, requires all three steps: notify in writing, obtain written consent, and treat the amount as clients’ money in a client account until you have permission to keep it. Advance informed consent through your engagement letter is permitted for unregulated activities, but you still have to tell the client the actual amount once received.

A related boundary issue caught 92 firms: referrals to restricted advisers, or referrals where the adviser’s status was not known. If you refer clients to a financial adviser, you are expected to know whether that adviser is independent or restricted, and to assess whether a restricted adviser can genuinely meet your client’s needs. If you are not confident making that assessment, ICAEW’s position is that you should refer only to independent advisers. Data protection was quieter, with the main finding being five firms that had not registered with the Information Commissioner’s Office.

The cyber security conversation larger firms had

Each year ICAEW picks an area of focus and discusses it in depth with larger firms. For 2025 it was cyber security, and it spoke to 121 larger firms. The self-reported confidence was near-universal: 99% of respondent firms felt they had good awareness of cyber threats and robust procedures, and 99% knew about the Cyber Essentials scheme.

The gap between confidence and evidence is where it gets interesting. Only 54% had completed the Cyber Essentials basic self-assessment and 29% Cyber Essentials Plus. Only 45% included cyber security risk in their organisational risk register. Just 32% had exercised a right to audit suppliers or require upward reporting, and only 25% had minimum supplier security requirements written into contracts. 73% held specific cyber insurance cover.

And 16% of respondent firms had suffered a cyber-attack, though not all resulted in a data breach. The incidents ICAEW describes are exactly the ones that hit accountancy practices: attempts to intercept payment instructions, compromised shared mailbox access, email account access through phishing, and ransomware. Of the firms attacked, 84% reported the incident to bodies such as the NCSC, ICO, HMRC or ICAEW, and 74% told affected clients or suppliers.

ICAEW’s recommendation is a governance one rather than a technical one: assign cyber risk to a senior business leader, put it in the risk register, write an incident response plan and test it at least annually, run supplier risk assessments, and set controls over data exchange. Notably, overall responsibility for cyber security sat with a non-specialist practice principal at 57% of respondent firms.

What ICAEW is looking at in 2026

Two areas of focus are named for 2026, and both will be discussed with larger firms during this year’s monitoring:

• Professional Conduct in Relation to Taxation (PCRT). The current version took effect on 1 January 2026. It applies to all members advising on UK tax, including employees of those members, and to members’ own tax affairs. The latest edition responds to government pressure on the professional bodies to lead more firmly on standards around the facilitation and promotion of tax avoidance, and the PCRT bodies have a working group drafting topical guidance on how PCRT applies to Making Tax Digital.
• Working with vulnerable clients. A newer theme for practice monitoring, and one where most small firms have practice but no policy.

If your firm is large enough to get the focus-area conversation, the question will be about policies and procedures, not intentions. A firm that has read PCRT and can point to how it applies its standards for tax planning is in a different position from one that has a copy on the shelf.

Why a buyer reads this report too

If a sale or succession is anywhere on your horizon, your last monitoring letter matters more than you might expect. It is one of the few documents in your practice that offers an independent, third-party read on how the firm is actually run — and unlike your management accounts, you did not write it. That makes it one of the first things a buyer asks for. Our guide to due diligence when selling your practice sets out what else gets opened.

A clean letter is a genuine asset: it shortens diligence and removes a whole category of argument. An open finding rarely knocks the headline multiple down. It does the more irritating thing — slows the process, widens the warranty and indemnity schedule, and pushes more of the consideration into deferral while the buyer satisfies itself the file is clean. That is the same shape as most avoidable value leakage, which we set out in what reduces the value of your practice.

The expensive version is the repeat finding. A buyer reading “this was raised at the previous review” is no longer looking at an administrative slip; they are looking at evidence about governance, and they will price the risk that other things have been let slide too. It is also worth reading this report alongside where AML supervision is heading — we covered the shift to a single FCA AML supervisor and the rulebook changes that landed on 30 June 2026. AML is the number one monitoring finding today, under a supervisor that knows the profession. It is unlikely to get more forgiving.

Your pre-visit self-review

None of this needs a consultant. It needs one afternoon and the published list of what inspectors find. Work through it in this order, because it is the order in which findings actually occur.

• Re-read your last monitoring letter. Every point on it. Is each one demonstrably closed, with a date and evidence? This is the highest-value ten minutes in the whole exercise.
• Date-stamp your firm-wide AML risk assessment. If it has not been genuinely reviewed in the last twelve months, that is finding number one, in 63% of reviews, waiting to happen.
• Open your standard terms of business. Does it state the basis of fees and the complaints procedure including the right to complain to ICAEW? Does it still describe services you no longer provide, or claim a DPB licence you do not hold?
• Check your ICAEW record. Principals, offices, trading names, ownership, regulatory contacts. Any structural change in the last year notified within 10 business days — and not via the annual return.
• Confirm your eligibility to use ‘Chartered Accountants’. Twenty-eight firms got this wrong. Structural changes are the usual cause.
• If you hold client money: trust letter on file, five-weekly reconciliations evidenced, designated accounts for £10,000-plus held over 30 days, annual compliance review documented, no fees taken without consent or before 30 days.
• Check PII against the September 2024 rules. Participating insurer, £2m minimum limit, the 2.5× gross fee income test if you are under £800,000, and your excess against the £3,000-or-3% cap.
• Commissions: written notification of amounts received, written consent to retain, and adviser status known before you refer.
• Cyber: is cyber risk named in a risk register with a named senior owner, and has the incident response plan been tested in the last twelve months?

The firms that find monitoring painless are not the ones with the best systems. They are the ones where the manual and the files say the same thing, and where last time’s findings were closed rather than filed. That gap is entirely fixable, and it is always cheapest to fix while nobody is asking.

Frequently asked questions

How often will ICAEW review my practice?

ICAEW says it aims to review all firms at least once every eight years, and that it may select a firm more frequently depending on risk factors — the size and complexity of the firm, its previous review history, and factors identified from ICAEW’s own risk monitoring. In 2025 it carried out 1,715 separate Practice Assurance reviews covering 2,068 firms, up from 1,185 reviews covering 1,489 firms in 2024. Reviews are delivered on site, by telephone or as desk-based reviews, and the outcomes differ sharply by method: desk-based reviews raised no matters requiring action at 99% of the firms seen, while on-site visits did so at 16%.

What is the most common compliance failure ICAEW finds?

Money Laundering Regulations breaches, by a wide margin, and for the second year running. ICAEW recorded 937 AML breaches, appearing in 63% of reviews and visits. Second place is a long way behind: 283 breaches relating to the basis of fees, complaints procedures and engagement letters, at 19%. Then ICAEW records and annual return data at 17%, Clients’ Money Regulations at 16%, and referrals and commissions at 11%. More than one area can apply to a single firm, so the numbers overlap. The practical read is that AML and basic client-communication paperwork account for most of what inspectors write up.

Can ICAEW fine my firm after a Practice Assurance visit?

Yes. Serious cases go to the Practice Assurance Committee, which considered 81 visit reports in 2025 against 45 the year before. It issued penalties of up to £10,000 to 44 firms, compared with 25 firms in 2024, and referred 37 firms to ICAEW’s Conduct Department for further investigation, against 23 in 2024. ICAEW flags one specific route to a referral: failing to act on points raised at your previous review. If you were given findings last time and did nothing, that history is the thing most likely to escalate an ordinary visit into a committee report.

Do I have to issue engagement letters to every client?

No. ICAEW is explicit that you do not have to issue engagement letters, but two things must be communicated to all clients in writing: the basis on which your fees are charged, and your complaints procedure including the client’s right to complain to ICAEW. In 2025, 273 firms had failed to tell clients one or both. ICAEW accepts alternatives — a standard terms of business letter, a brochure given to the client, or a paragraph in the initial correspondence. Inspectors also found engagement letters that were out of date, silent on specialist services, or wrongly claiming the firm could do licensed investment business work.

Does a monitoring finding affect what my practice is worth?

Your last monitoring letter is one of the first documents a serious buyer asks for, because it is an independent read on your compliance function that you did not write. A clean letter shortens diligence. An open finding does not usually cut the headline multiple — it slows the deal, widens the warranty schedule, and pushes more of the price into deferred consideration while the buyer satisfies itself the file is clean. The expensive version is a finding you were told about at the previous review and never closed, because that reads as a governance problem rather than an administrative one.