ICAS practice monitoring

Q: Which regulatory requirements are most likely to be tested?

Several of the areas above rest on specific ICAS rules: Contingency arrangements. Regulation 3.20 of the Public Practice Regulations requires a sole practitioner to certify that written arrangements exist for the firm's functions to continue with minimal disruption if they die or become incapacitated. See practice succession. Designations. Websites, letterheads and advertising are checked for correct use of designations such as Chartered Accountants, which can change when principals join or leave. Clients' money, PII and CPD, each governed by its own ICAS regulations. See client money rules and CPD requirements. Fee protection. Arrangements offered to clients are reviewed; see fee protection rules by professional body.

Q: How should a firm prepare?

Illustration only. A three partner Glasgow firm receives notice of a Practice Review eight weeks away. It sends the requested pre visit information by the deadline and rereads the findings from its last visit and its own internal compliance review. It checks that its letterhead and website use the Chartered Accountants description correctly following a partner's retirement, confirms its fee protection arrangements, and updates its firm wide AML risk assessment. It also writes up how staff may use AI tools with client data. The senior partner keeps the day clear for the opening and closing meetings and prepares questions for the reviewer.

ICAS members who hold a practising certificate must receive a monitoring visit to their firm, now called a Practice Review and referred to in the Public Practice Regulations as practice monitoring. Firms can typically expect a visit at least once every six years, and most visits end with a clearance letter and no follow up. Serious problems go to the Authorisation Committee, which can require follow up, impose conditions on a licence or regulatory penalties, or refer a firm for investigation.

Tax investigation insurance from £108.75 a year (£9.06 a month).Pays up to £100,000 of your accountant's fees if HMRC opens an enquiry. No excess. Buy online in a few minutes.

See my price in 2 questions How the cover works Accountant? Offer cover to your clients or call 01795 841 310

Who has to be monitored by ICAS?

ICAS says its Public Practice Regulations require every member holding a practising certificate to receive a Practice Review visit. The review also covers the work of others who have agreed to be included, typically the other principals in the firm. ICAS visits the firm rather than each certificate holder, and all offices are covered in the same visit where practical. Its guide to starting in practice says any member offering accounting and related services, personally or through a firm, needs a practising certificate, that all ICAS principals in the firm need one, and that the firm must have professional indemnity insurance. A new firm will usually get its first visit after it has submitted its first Firms Annual Return.

Some exemptions exist, typically where the practitioner or firm is already subject to a comparable review programme run by another accountancy body, ICAS has agreed that its scope is equivalent, and there is a reciprocal agreement with that body. ICAS says that where the majority of principals are ICAS members, the review must be carried out by ICAS. Firms with audit registration or an insolvency licence are also subject to audit or insolvency monitoring.

How often are visits, and how is a visit arranged?

ICAS says firms can typically expect a visit at least once every six years, with frequency and timing depending on the firm’s size, complexity, previous visit history and risk. The process starts with a visit notification asking the firm to join a call at a proposed time. If that time does not suit, ICAS asks you to contact it immediately. The purpose of the call is to agree a visit date within the period the reviewer specifies, explain the process and set out the information needed. The length of the visit depends on the size of the firm and the range of its services, and the reviewer gives an estimate on the call.

Cooperation is expected. ICAS states that firms must cooperate fully and promptly with its committees and staff and use their best endeavours to accommodate the monitoring process, and must give full and accurate information in the ICAS AML Declaration.

The programme has run since 2000, previously under the names Practice Monitoring and Quality Review. ICAS notes that no practice monitoring annual reports were produced for 2021 to 2024 because the regime was put on hold, and that it was to return in 2025.

Run an accountancy or bookkeeping practice? Solar Protect runs fee protection schemes for practices, so the cost of dealing with an HMRC enquiry into a client is covered rather than written off.

See how our accountant schemes work or call 01795 841 310.

What does a Practice Review cover?

A pre visit call agrees the date and whether the visit will be on site or by Teams. The reviewer prepares using the firm’s previous visit results, its Annual Return and any information sent in advance. The visit opens with a meeting, usually with the senior partner, to understand the firm, its services and its clients. ICAS lists these areas as covered:

firm structure, constitution and licences, and the use of designations on websites, letterheads and advertising;
fees and commission, ethics and clients’ money;
engagement and disengagement, quality management policies and procedures;
PII, claims, notifications and complaints procedures;
Designated Professional Body work for investment business and consumer credit;
fee protection insurance;
CPD, the Bribery Act and sole practitioner contingency arrangements;
IT issues such as the use of artificial intelligence.

Reviewers also look at a small sample of unincorporated accounts, company financial statements and charity accounts or independent examinations, to check that the right framework is applied. They may sample other services, including payroll, VAT, other tax compliance, research and development claims, tax advisory work and information supporting mortgage applications. ICAS stresses that these are not technical reviews and that it does not form judgements on your advice or look at client affairs in depth. The reviewer will also confirm that weaknesses found last time have been fixed.

Which regulatory requirements are most likely to be tested?

Several of the areas above rest on specific ICAS rules:

Contingency arrangements. Regulation 3.20 of the Public Practice Regulations requires a sole practitioner to certify that written arrangements exist for the firm’s functions to continue with minimal disruption if they die or become incapacitated. See practice succession.
Designations. Websites, letterheads and advertising are checked for correct use of designations such as Chartered Accountants, which can change when principals join or leave.
Clients’ money, PII and CPD, each governed by its own ICAS regulations. See client money rules and CPD requirements.
Fee protection. Arrangements offered to clients are reviewed; see fee protection rules by professional body.

How does ICAS deal with anti money laundering failures?

ICAS is an AML supervisory body and takes a risk based approach. In April 2025 it introduced guidance on its response to firms not meeting the Money Laundering Regulations 2017: it may arrange additional monitoring visits, impose conditions or restrictions on a firm’s licence, or make a regulatory penalty. By September 2026 the Authorisation Committee had issued 21 regulatory penalties under that guidance, ranging from £100 to £3,000. The largest went to firms without robust enhanced due diligence for higher risk clients. Penalties are only raised where a visit finds repeated or systemic issues, and are not offered where a breach calls into question whether ICAS should continue to supervise the firm.

The most common failings ICAS lists are not identifying all beneficial owners (and directors of corporate clients), not verifying identity, missing client risk assessments, missing know your client records, not considering enhanced due diligence, no evidence of ongoing monitoring, inadequate AML policies, no firm wide risk assessment, inadequate staff training and poor communication with ICAS, including inaccurate AML declarations. Our pages on AML supervisory reviews and enhanced due diligence explain what good looks like.

What happens at the end of the visit?

A closing meeting with the senior partner covers the issues found, with guidance, recommendations and, where regulatory issues exist, requirements. A draft report is either discussed on the day or sent soon after, and the practitioner’s comments are normally required within two weeks. ICAS runs independent quality checks over visits for consistency. It says most visits end with a clearance letter and no follow up, and a copy of the final report is kept on the firm’s file at ICAS.

The Authorisation Committee oversees Practice Review. Where the reviewer finds more serious concerns, the committee makes the final decision on whether the firm must take follow up action, and the reviewer will tell you if that is possible and when the committee next meets. For AML failings it can also impose conditions or restrictions on a firm’s licence. In exceptional cases, such as an ethical or clients’ money breach, it can impose regulatory penalties or refer the firm to the Investigation Committee; ICAS says these situations are infrequent. Some regulatory outcomes are published on its website.

How should a firm prepare?

Illustration only. A three partner Glasgow firm receives notice of a Practice Review eight weeks away. It sends the requested pre visit information by the deadline and rereads the findings from its last visit and its own internal compliance review. It checks that its letterhead and website use the Chartered Accountants description correctly following a partner’s retirement, confirms its fee protection arrangements, and updates its firm wide AML risk assessment. It also writes up how staff may use AI tools with client data. The senior partner keeps the day clear for the opening and closing meetings and prepares questions for the reviewer.

What mistakes cause problems?

Not responding promptly to the visit notification or missing the deadline for pre visit information.
No written contingency arrangement for a sole practitioner.
Generic AML documents and client files without risk assessments or verification evidence.
Not correcting weaknesses found at the previous visit.
Inaccurate Firms Annual Return or AML declaration answers.

For how the other main bodies approach monitoring, see ICAEW Practice Assurance and ACCA practice monitoring.

Solar Protect runs fee protection schemes for accountancy and bookkeeping practices. See how our accountant schemes work or read fee protection schemes for accountants.

Related Accountapedia entries

Sources

Reviewed by Christine Anderson, Broker, Solar Protect. Last reviewed 8 October 2026. Part of Accountapedia, the Solar Protect guide to UK tax and accounting. This page is general information, not personalised advice.