Audit outsourcing in the UK: the models, and who stays responsible

Audit outsourcing in the UK is lawful and increasingly common, but it moves the work, never the responsibility. Only an individual or firm eligible under the Companies Act 2006, in practice one registered by a recognised supervisory body such as ICAEW, can be appointed as auditor. The appointed firm's engagement partner takes responsibility for the direction, supervision and review of everyone who performs audit procedures, wherever they sit, and the firm's quality system has to cover them. This guide is for responsible individuals (RIs) and practice owners short of capacity who are deciding whether to outsource audit work. It compares four models: outsourced or offshore support inside the firm's team; subcontracting to another audit firm; introducing the audit to a registered firm; and partnering with an introducer that also supplies software.

What is audit outsourcing in the UK?

Audit outsourcing in the UK means audit work done by people the auditing firm, or its network, does not employ. ICAEW defines "outsourcing" as audit work "performed by staff not employed by the firm or a network firm, whether on or offshore", and "offshoring" as audit work "performed by staff outside the jurisdiction in which the auditor reports, regardless of who employs the staff". A firm's own overseas delivery centre is offshoring without outsourcing; a UK contractor is outsourcing without offshoring.

ICAEW reported in December 2024 that outsourced and offshored audit work "has grown in recent years". Its article, based on conversations with senior staff at five larger and mid-tier firms, says "for some, 30-40% of audit hours are now outsourced", without saying which firms or how the hours were measured: it is not a market-wide figure.

One rule holds across every model. A company that needs an audit must appoint an auditor for each financial year (sections 485 and 489); only a member of a recognised supervisory body that is eligible under its rules may be appointed (section 1212(1)); and acting as statutory auditor while ineligible is a criminal offence (section 1213). ICAEW Audit Regulation 2.01: "No individual or firm may accept an audit appointment unless registered by an RSB or the Competent Authority."

Four models compared: who is appointed, who does the work, who signs

The models differ in where the people doing the work sit, not in who answers for it.

What audit work can be outsourced, and what stays with the engagement partner?

A firm can outsource the performance of audit procedures, such as inspection, confirmation, recalculation and analytical procedures (ISA (UK) 220 (Revised) A17–A18; the procedures are listed in A16). It cannot outsource the engagement partner's responsibility, including the basis for determining that the significant judgements are appropriate (paragraph 13): a partner who assigns tasks "shall continue to take overall responsibility" through direction, supervision and review (paragraph 15).

Offshore audit support and UK outsourced teams

ICAEW heard of two basic models of offshore audit support and outsourced audit support services: a "ticketing" model, in which work sent to a service centre is picked up by the next available person, and one in which "a named individual at the service centre ... becomes part of the audit team". Either can be onshore or offshore, inside the firm's network or with a third party.

Under ISA (UK) 220 (Revised) the label does not matter. The engagement team includes "any other individuals who perform audit procedures on the engagement" (paragraph 12(d)), wherever they are located (A15), including individuals from another firm or "another service provider" (A17) and from service delivery centres (A18). Whoever performs a ticketed task that is an audit procedure is a member of the engagement team.

In the firm's system, individuals from a third-party provider are resources from a service provider (ISQM (UK) 1 paragraph 16(v)). One of the quality objectives the firm must establish is that such resources are appropriate for use (paragraph 32(h)), and the firm stays responsible for its system "even when" it uses them (paragraph 11). The firm-level detail is in ISQM (UK) 1 service providers.

ICAEW's Audit Regulations count anyone who carries out audit work for a registered auditor, "including a sub-contractor or a consultant", as an employee (definitions), and the firm must make arrangements so that everyone it employs or permits to be involved in its audit work is fit and proper (regulation 3.06). Where a firm uses individuals resident in another country for its own audit work (not being the audit of a foreign subsidiary), it "should undertake and document appropriate steps" to establish, within that country's law, that they are fit and proper, independent and competent (guidance to regulation 3.07).

What the engagement partner cannot hand over

These stay with the engagement partner under ISA (UK) 220 (Revised), however much of the work is outsourced:

1. Overall responsibility for quality, with involvement "sufficient and appropriate" to judge whether the significant judgements and conclusions are appropriate (paragraphs 13 and 40).
2. Deciding that the team is enough: sufficient and appropriate resources, and a team that collectively has the competence and capabilities, "including sufficient time" (paragraphs 25 and 26).
3. Responsibility for direction, supervision and review of every team member's work (paragraphs 29 and 30).
4. Reviewing the documentation on significant matters and significant judgements, including difficult or contentious ones (paragraph 31).
5. Concluding that the evidence is sufficient and appropriate, on or before the date of the auditor's report (paragraph 32).
6. Reviewing the financial statements and the auditor's report before dating it (paragraph 33).
7. Determining whether ethical requirements, including independence, have been fulfilled before the report is dated (paragraph 21).

The guidance to regulation 3.07 says the same from the registration side: "responsibility for the overall direction of the audit, its supervision, performance and reaching a conclusion that sufficient and appropriate audit evidence has been obtained prior to signing the audit report must always be in the hands of responsible individuals". A sub-contractor or consultant "cannot become a responsible individual" (definitions).

Two common claims need correcting. ISA (UK) 220 (Revised) asks that the engagement team, reviewers included, collectively has the competence and capabilities, including sufficient time (paragraph 26); it does not frame this as membership of a particular institute, although overall direction must rest with responsible individuals (above). And within the audit, the ISAs (UK) put overall responsibility for the engagement on the engagement partner, and for the system of quality management that supports them on the firm (paragraph 29-1).

Can you subcontract audit work to another audit firm?

Yes. A registered firm can subcontract work to another firm, "whether registered or not", but it remains the auditor, and the other firm's people who perform audit procedures join its engagement team. ICAEW's guidance says there "should be a formal engagement letter or contract" making "clear who is responsible for the different parts of the accountancy and audit work", and "a sub-contractor should be treated as an employee for the purposes of the work" (guidance to regulation 3.06).

Three points follow. Working papers: the appointed firm must arrange that the other firm returns all the papers it creates, or keeps them for at least the six years regulation 3.11 requires and allows "unrestricted access" (regulation 3.12). Quality: the other firm's people "may not be subject to the firm's system of quality management", so the firm may need other evidence of their competence, understanding of ethical requirements and independence, "such as written confirmation" (ISA (UK) 220 (Revised) A24–A25). Independence: under the FRC's Ethical Standard every engagement team member is a "covered person" who must be independent.

A component auditor is different: ISA (UK) 600 (Revised) defines it as an auditor doing work "related to a component for purposes of the group audit". That standard, "adapted as necessary", may still help outside a group audit when another firm's people attend a stock count or work at a shared service centre at a remote location (paragraph 3). The group rules are in the guide to ISA (UK) 600 (Revised).

Partnering with an audit firm: introductions and shared platforms

Two models move the whole audit to a registered firm instead.

Introducing an audit to a registered firm

A practice not registered for audit, or a firm that cannot take a particular client, can introduce the client to a registered firm, which is appointed and does the audit. The introducer is not the auditor and performs no audit procedures, so it is outside the engagement team. A professional accountant paid for referring its own client needs the client's "explicit written consent" to keep the fee, "regardless of the amount" (ICAEW Code R330.5B). Practices that want to refer a client for audit can see how that works.

Partnering arrangements

In a partnering arrangement, one party brings audit clients and software, and the registered firm accepts each appointment on its own terms, does the audit and signs. The engagement partner still determines that the firm's acceptance procedures were followed (ISA (UK) 220 (Revised) paragraph 22), and the software, like "a commercial IT application used to perform audit engagements" (ISQM (UK) 1 A105), is a service provider resource that must be appropriate for use (paragraph 32(h)). A referral fee paid or received creates a self-interest threat (Code 330.5 A1); disclosing it to the client "might address" that threat (330.5 A2). ICAEW's Technical Advisory Service adds (March 2025) that unless the threats to independence can be eliminated or reduced to a level at which independence is not compromised, "audits should not be accepted with a referral fee arrangement in place".

Innate, which publishes this guide, is a software company that works with audit firms in this way: it introduces companies that need an audit and provides the platform, and the audit firm is appointed and signs.

Who stays responsible when audit work is outsourced?

In all four models the appointed firm and its engagement partner answer for the audit.

• Appointment. Only the registered firm can be appointed (section 1212(1); Audit Regulation 2.01). No outsourcing provider, subcontractor or introducer holds the appointment.
• Signature. Where the auditor is a firm, the report is "signed by the senior statutory auditor in his own name, for and on behalf of the auditor" (section 503(3)).
• The engagement. The engagement partner takes overall responsibility for quality and for the direction, supervision and review of the whole engagement team, outsourced, offshore and subcontracted members included (ISA (UK) 220 (Revised) paragraphs 13, 15 and 29).
• The firm's system. The firm bears overall responsibility for the quality system that supports the engagement partner (paragraph 29-1) and stays responsible for it when it uses service providers (ISQM (UK) 1 paragraph 11). Its ISQM 1 annual evaluation covers that whole system, resources from service providers included.
• The file. ISA (UK) 230 requires a record of "who performed the audit work and the date such work was completed" and "who reviewed the audit work performed and the date and extent of such review" (paragraph 9). On an outsourced audit, that record is the evidence that paragraph 29 was met.

FRC offshore audit scrutiny: what the 2026 review said, and what it means for a smaller firm

The FRC's Annual Review of Audit Quality 2026, published on 22 July 2026, notes that some firms "are increasing the use of offshore delivery platforms to incorporate remote teams into the onshore team, sometimes referred to as the extended team model", and says "firms should ensure they have adequate oversight over their remote audit teams which are increasingly being asked to exercise professional judgement, including on complex audit matters" (page 27).

Its monitoring commitment names the largest firms: "Over the next year, we will continue to monitor how the largest audit firms meet the respective challenges of building and sustaining their expanded resource models" (page 28). The same page says the FRC continues to "monitor, challenge and guide firms" on their resourcing challenges, involving RSBs where relevant. A culture case study describes firms that embedded remote teams "fully within quality management arrangements", which "helped to achieve consistency of audit quality across locations" (page 28), and the Forvis Mazars appendix records a focus on consistent audit quality "especially as use of offshore teams increases" (page 69). The review announces no separate offshore inspection programme. See the guide to the FRC Annual Review of Audit Quality.

For a firm that audits private companies, the inspector is normally its recognised supervisory body: the FRC's inspection programme focuses on public interest entity audits, and RSB inspections cover private company audits under delegation from the FRC (pages 16 and 21). ICAEW's Audit Monitoring Report 2026 has no section on outsourced or offshore work. Its nearest finding is a group-audit case study: on a group earning over 90% of its revenues through overseas subsidiaries, the UK firm "explained that it had reviewed the work done by the component auditors", but "no details were included on the audit file" (page 8).

On an outsourced audit, a reviewer can check the file for:

• who performed each piece of work and who reviewed it, with dates (ISA (UK) 230 paragraph 9);
• engagement partner review of the significant judgements, not only sign-off ticks (ISA (UK) 220 (Revised) paragraph 31);
• direction, supervision and review adapted to where remote team members sit, which for service delivery centres may be "more formalized and structured" (ISA (UK) 220 (Revised) A95);
• evidence that the outsourced individuals are fit and proper, competent and independent (regulation 3.06 and the guidance to 3.07; ISA (UK) 220 (Revised) A25).

Client data, confidentiality and the engagement letter

Do you have to tell clients their audit work is done offshore? ISA (UK) 210 does not require the engagement letter to say so, but the ICAEW Code's confidentiality rules make telling the client, and agreeing it in the letter, the straightforward course. Where client records contain personal data, data protection law applies as well.

Confidentiality. The ICAEW Code requires reasonable steps so that "personnel under the accountant's control, and individuals from whom advice and assistance are obtained, comply with the accountant's duty of confidentiality" (R114.1(d)), protecting information through its "collection, use, transfer, storage or retention" (114.1 A1). Otherwise confidential information may be disclosed only under a legal or professional duty or right, or with the client's authorisation where the law does not prohibit it (R114.2–R114.3). The Code does not say whether letting an outside provider access client records is such a disclosure or falls within R114.1(d); the client's authorisation settles it either way.

Processor terms. Where the audit firm is the controller of personal data in the client's records and a provider processes it on the firm's behalf, UK GDPR Article 28 requires a binding contract. It must, among other things, limit the provider to the firm's documented instructions, "including with regard to transfers of personal data to a third country", bind its staff to confidentiality, and provide for return or deletion at the end.

Transfers outside the UK. Since 5 February 2026, after amendment by the Data (Use and Access) Act 2025, UK GDPR Article 44A allows a transfer of personal data to a third country only if it is approved by regulations, made subject to appropriate safeguards, or made under a derogation, and otherwise complies with the UK GDPR. In the ICO's own example, a UK business that lets an organisation in India access personal information on its systems is making a restricted transfer. India, the Philippines and South Africa are not on the ICO's list of UK adequacy regulations, so a firm using a team there would normally rely on safeguards such as the International Data Transfer Agreement or the UK Addendum. Those count only if the firm, "acting reasonably and proportionately, considers that the data protection test is met": that protection after the transfer "would not be materially lower" (Article 46(1A) and (6)). The ICO still calls this a transfer risk assessment.

The engagement letter. ISA (UK) 210 does not list outsourced work among the letter's required contents (paragraph 10); its application material says the letter could, when relevant, cover arrangements for "the involvement of other auditors and experts in some aspects of the audit" (A26). Given R114.3, the straightforward course is to tell the client who will work on the audit, where, and on what data terms, and to have the client agree it in the letter. The wording is covered in the guide to the audit engagement letter.

Which model suits your firm?

The right model depends on what is short: hours, review time, a skill, or the ability to take the client. The table states conditions, not recommendations.

If capacity limits how many audits you can accept, partner with us: our platform finds documents, reconciles figures and helps your team prepare its work, saving it hours, and you remain the auditor and sign.

Whichever model a firm chooses, the file has to show who did the work, who reviewed it and when. More guides for practice owners are under UK auditing standards.