Cold and hot file reviews: what reviewers find, and how to fix it first

A cold file review is an inspection of a completed audit, carried out after the auditor's report has been signed, to test whether the firm's system of quality management worked on that file. A hot file review looks at a file before the report is signed, while the work can still be changed. Under the ICAEW Audit Regulations in force from 1 October 2026, every ICAEW-registered firm must inspect at least one completed audit each year and cover each responsible individual (RI) at least once every three years. This guide is for the RIs, audit compliance principals and managers who plan those reviews. It sets out the rules, who may do the work, and the weaknesses ICAEW's own reviewers report, so that they can be caught before the report is signed.

What is a cold file review?

It is the "inspection of completed engagements" that ISQM (UK) 1 requires as part of a firm's monitoring (paragraph 38). ICAEW's Technical Advisory Service calls it an "audit compliance cold file review" and notes that ISQM 1 refers to it as a "review of completed engagement". The guidance to Audit Regulation 3.20 gives its purpose: to "provide evidence of the effectiveness (or otherwise) of the firm's system of quality management and that auditing standards were followed."

Two points follow. A cold review is not a re-audit: it is evidence about the firm's system, read from one file. And it comes too late to change the opinion on that file. What it can do is find that "procedures required were omitted" or that "the report issued may be inappropriate", and ISQM (UK) 1 paragraph 45 then requires the firm to act, including, where the report is considered inappropriate, "considering whether to obtain legal advice".

What the reviewer reads is the file. ISA (UK) 230 paragraph 8 requires documentation that lets "an experienced auditor, having no previous connection with the audit" understand the work, its results and the significant judgements, and in the UK the file must be assembled "no later than 60 days from the date of the auditor's report" (paragraph 14). See ISA 230 audit documentation and audit file assembly.

Hot file review vs cold review: which, and when

Three reviews are often confused: the hot review, the cold review and the engagement quality review (EQR). They differ in when they happen, who requires them and what they can change.

No auditing standard requires a hot review. The FRC's Thematic review: Hot Review Processes (January 2024), which covered the seven Tier 1 firms, says hot reviews "are not specifically defined or required by auditing standards", and for its purposes defines one as "an internal independent review of in-progress audit work". ICAEW's usage is wider: the ARC case below required external hot reviews. Nor do the Audit Regulations require them. ISQM (UK) 1 leaves room for them: a firm's responses to quality risks "may include other forms of engagement reviews that are not an engagement quality review", such as reviews of "the engagement team's procedures relating to significant risks" (A135). ICAEW's Audit Monitoring Report 2026 names two situations where they appear: "early hot reviews of files" after a change of audit software, and conditions set by the Audit Registration Committee (ARC).

Is there an ICAEW hot file review checklist?

Not in the helpsheet. ICAEW's helpsheet contains two documents: the Cold File Audit Compliance Review Checklist and a draft external reviewer declaration. It is written for completed audits. A firm that runs hot reviews sets their scope itself, or follows the scope an ARC condition gives it.

How often do ICAEW firms need a cold file review?

At least once a year, and for each RI at least once every three years. Regulation 3.20 requires a registered firm to "monitor, at least once a year, how effectively it is complying with these regulations". For the smallest firms, the guidance says, monitoring "may be focused on an annual audit compliance review process". It splits that monitoring into two parts:

• the "whole-firm" procedures, from governance and ethics to acceptance and continuance, professional indemnity insurance and continuing eligibility;
• the inspection of completed engagements: the cold reviews.

ISQM (UK) 1 paragraph 38(c) requires the firm to "select at least one completed engagement for each engagement partner on a cyclical basis determined by the firm". The standard's own example of a cycle is once every three years for engagement partners on audits (A153), but it is only an example. The guidance to regulation 3.20 turns it into a rule for ICAEW firms: "to comply with these regulations" a firm's procedures "must also meet" two criteria:

1. "The cycle of inspection of completed engagements for each responsible individual must not exceed three years."
2. "Monitoring must include at least one inspection of a completed engagement, each year."

The guidance adds that a firm should monitor each year even in a year when ICAEW has inspected it. And three years is a ceiling: A153 suggests selecting an engagement partner more often when, for example, they are newly appointed, work in a complex industry or one they know less well, or other monitoring was unsatisfactory.

A worked three-year cycle for two invented firms

The table shows one way two invented firms could meet both criteria over six years. Firm S is a sole practitioner with no suitable internal reviewer. Firm T has two RIs, each able to inspect the other's completed audits. It is an illustration, not a policy and not the minimum for any real firm.

Firm S's longest gap between inspections that count for ISQM (UK) 1 is three years; its other reviews are the additional ones the guidance relaxes (see below).

Firm T inspects each RI every two years, but only if each passes ISQM (UK) 1's objectivity test for the other's audit: neither was on its team or its EQR (paragraph 39(b)), and A155 warns of a self-review threat where the reviewer worked on a later year's audit. Paragraph 39(b) also requires policies that "address the objectivity" of reviewers, so two partners reviewing each other must be considered, not assumed. Failing that, Firm T is in Firm S's position and needs an external reviewer at least once every three years.

Who can carry out a cold file review?

Someone with the competence and time, whose objectivity the firm has addressed, who was not on that audit's engagement team or its engagement quality reviewer. ISQM (UK) 1 paragraph 39 requires policies that call for "the competence and capabilities, including sufficient time", that "address the objectivity" of those doing the monitoring, and that "prohibit the engagement team members or the engagement quality reviewer of an engagement from performing any inspection of that engagement".

The guidance to regulation 3.20 then relaxes the rule for the reviews that go beyond what ISQM (UK) 1 needs. Where the one-a-year rule produces extra reviews, the firm may use a reviewer who is not independent of the engagement team "providing it considers that the selected individual is able to conduct the review with a sufficiently independent and objective mindset". The helpsheet says the same for small firms: between external reviews the review "may be completed by someone who was part of the engagement team".

So a sole practitioner, who is always the audit compliance principal under regulation 3.21, may do the additional reviews of their own audits but cannot do the inspection that counts for ISQM (UK) 1, having been on the engagement team. For that, unless the practice has another suitable internal reviewer, the guidance says the firm "should engage an external reviewer at least once every three years". ISQM (UK) 1 A156 allows a less complex firm to "use network services or a service provider to perform the monitoring activities".

Choosing and scoping an external reviewer

The helpsheet lists what to settle with an external reviewer, "preferably in writing":

• competence, independence, fit and proper status and confidentiality;
• the scope of the review and how it will be reported;
• the reviewer's liability, and an undertaking not to accept appointment for professional services for the clients reviewed;
• notice to clients: "the client should be advised of external quality control reviews, normally within the engagement letter".

None of this moves the responsibility. "Using an external reviewer does not reduce the firm's own responsibility for the review, evaluation of deficiencies or for ensuring that any necessary action is taken."

What the ICAEW cold file review checklist covers

The checklist comes with a Technical Advisory Service helpsheet, first published in September 2013 and last reviewed on 11 March 2026. The checklist and the draft external reviewer declaration are downloads restricted to ICAEW members and other eligible users; the public page sets out what the checklist is for.

A cold review, the helpsheet says, checks "that the firm's audit procedures, the Ethical Standard for Auditors (ES), the Auditing Standards (ISAs) and the ICAEW Audit Regulations (Reg) have been complied with and that the accounts comply with all the appropriate disclosure requirements". The checklist is for audits under the revised ISAs (UK), and ICAEW warns that it may need "additions and amendments" for a firm's own circumstances and for "listed company, regulated or specialist audits, or audits not conducted under the Companies Act".

What any inspection must test comes from the standard rather than the checklist. Ordinarily, ISQM (UK) 1 says, it "includes determining that responses that are implemented at the engagement level (e.g., the firm's policies and procedures in respect of engagement performance), have been implemented as designed and are operating effectively" (A154). A checklist answered without reading the evidence behind each answer does not do that.

What ICAEW's reviewers find on audit files

In 2025 ICAEW completed 375 audit monitoring visits, "incorporating reviews of firms' work on 667 audits". It found 73% of audits good or generally acceptable, and the share needing significant improvement fell to 6% from 10% in 2024. ICAEW adds two cautions: the population of firms differs each year, so the figures are not directly comparable, and an audit needing significant improvement "does not necessarily mean that the audit opinion was incorrect".

The report says the weaknesses it finds "have not substantially changed", and names the areas from its previous report: risk assessment, fraud and error, estimates and judgements, experts and service organisations, substantive analytical procedures and sampling. Its 2026 examples follow, grouped by area; the order is not a ranking.

The report's sharpest line is about the financial statements: "when we can identify that the financial statements are materially misstated simply from review of the audit file documentation, this is a clear failure by the auditor." It says the root cause of its related party disclosure errors is "often attributed to lack of time and attention by audit RIs and staff at the completion stage", and points to RIs and managers who "can seem to prioritise process (eg, review of working papers and signing off checklists) at the expense of the final output". Fraud work is one of the standing weakness areas; the revised fraud standard is covered in the guide to ISA (UK) 240 (Revised).

How to fix it first: catching findings before the report is signed

Each finding above was found by reading the audit file, so a review of the file before signing is where it could have been caught.

1. Give the completion stage time. The report links related party disclosure errors to lack of time at completion. Before dating the report the engagement partner must "review the financial statements and the auditor's report" (ISA (UK) 220 (Revised July 2021) paragraph 33): review the accounts against the file, not only the papers and checklists.
2. Make the disclosure checklist an expert's job. Tailor it to the entity and have it completed, or at least reviewed, by someone who knows the requirements.
3. Keep everything inside the audit system. A ticked box does not record "what was done, the information that was considered, or the judgements made".
4. Review delegated work, and target the risky areas. ISA (UK) 220 (Revised July 2021) paragraph 31 requires the engagement partner to review documentation on significant matters and judgements during the audit; ISQM (UK) 1 A135 lets a firm add a review of the team's work on significant risks or judgements.
5. Hot-review early after any change of audit system. The report recommends "early hot reviews of files" after a change, and asks firms moving to "a second or third audit platform" to keep the same challenges in mind.

After the review: findings, action plan and follow-through

A cold review only helps if the firm acts on it. ISQM (UK) 1 paragraphs 40 to 44 set the sequence: decide whether the findings amount to deficiencies; judge their severity and pervasiveness by investigating root causes (see audit root cause analysis); design remedial actions that answer those causes; and check that the actions were implemented and worked, changing them if not.

The helpsheet adds the practical steps: agree "a suitable action plan", and communicate "the results of the cold file review and the action plan … to those in the firm involved in the audit work". ISQM (UK) 1 paragraph 47 requires a similar communication: engagement teams are told the monitoring performed, the deficiencies found and the remedial actions. The results then feed the firm's ISQM (UK) 1 annual evaluation.

When ICAEW requires file reviews: QAD and ARC

A visit outcome takes in overall audit quality across the files reviewed, the adequacy of the firm's policies and procedures (for non-PIE firms), its root cause analysis of the more significant findings, and its commitment and ability to address them. Follow-up after a visit (see what happens on an ICAEW QAD visit) "may include … submission of cold file reviews of subsequent audits".

Where the problems are more serious, the matter goes to the ARC, a committee with equal numbers of lay and chartered accountant members and a lay chair. Under regulation 7.01 it may impose conditions or restrictions; the guidance gives "'cold reviews' of audit files by another registered auditor" as an example, and the report adds conditions "to undertake hot or cold file reviews on all, or a selection of audits". In 2025 the ARC imposed conditions or restrictions on the registration of 32 firms (41 in 2024) and withdrew registration from two. In one case a firm was put on "a series of external hot and cold file reviews", a detailed action plan with updates every six months, and a bar on new audit clients without permission.

Innate does not carry out cold or hot file reviews. It builds audit software for the firms that do the audits. If you want your team's review time on the file to go on judgement, partner with us: we bring clients and a platform designed to save your team hours on the legwork, and your firm remains the auditor and signs.

More guides for audit firms are collected under UK auditing standards and regulation.