The ICAEW Practice Assurance visit: what it checks, and where firms actually fail

What a Practice Assurance visit actually is

Practice Assurance is ICAEW’s quality monitoring scheme for its member firms. It exists to check that a practice holding out as ICAEW-regulated actually operates to the standards that description implies — proper client money handling, adequate professional indemnity cover, a working anti-money-laundering programme, and engagement letters that set out what clients are paying for and how to complain if something goes wrong.

Visits are risk-based rather than fixed to a calendar, so a larger, more complex or previously flagged practice is reviewed more often. But there is a backstop: every registered firm is due a review at least once every eight years regardless of risk score, so “we’ve never been visited” is a countdown, not an exemption. A pre-review call usually lands seven to fourteen days before the visit itself, at which point the reviewer tells you what to have ready — which is exactly the point most practices realise their paperwork has not been touched since it was first written.

What ICAEW’s own data says actually goes wrong

ICAEW publishes the results of its own monitoring every year, and the 2026 report — covering the 2,000+ on-site, telephone and desk-based reviews carried out in 2025 — is unusually specific about where practices fall down. Two findings dominate, and both are recurring: the same two issues topped the list in 2024 as well.

Source: ICAEW Practice Assurance Monitoring Report 2026. Figures are ICAEW’s published findings, not Optivo research.

The headline is not that practices are badly run — ICAEW itself reports that at 88% of the practices reviewed, it either raised no matters requiring action or the practice cleared what was raised with no follow-up needed. The headline is where the remaining 12% actually trip up: a firm-wide AML risk assessment that was written once and never revisited, an engagement letter template last updated before a fee change, a complaints procedure nobody has told new joiners about. None of that is a competence problem. It is an ownership problem — a document existing somewhere is not the same as a document being current, and nobody in most practices has “keep this current” as an actual job.

A worked example: the eighteen-month gap

Picture a twelve-partner practice booked in for an on-site visit after a routine risk-based selection — nothing has gone wrong, it is simply their turn. The pre-review call asks for the firm-wide AML risk assessment, and the version on file is eighteen months old, written when the practice had two fewer service lines and no crypto-asset clients. Nothing in it is wrong exactly; it is just no longer a description of the firm as it actually operates.

The Money Laundering Reporting Officer updates it in an afternoon before the visit. That is not the expensive part. The expensive part is that the reviewer’s report now records that the risk assessment was not being kept current as a matter of routine, which is a Practice Assurance Committee-level observation if it recurs at the next review. A document that gets fixed once, under deadline pressure, and then left for another eighteen months has not actually solved the problem — it has just moved the same finding to a later date.

What “good” looks like between visits

The practices that sail through a Practice Assurance visit are not the ones that scramble hardest in the fortnight before it. They are the ones where the underlying documents are already part of how the firm runs, reviewed on a schedule rather than rediscovered under pressure:

• A firm-wide AML risk assessment reviewed at least annually, and re-issued whenever the client base, services or geography genuinely changes
• An engagement letter template that is actually re-issued to existing clients when scope or fees change, not just used for new ones
• A written complaints procedure that every member of staff, not just partners, can point to
• Client due diligence evidence held on file and not “known to us for years” in someone’s head
• A named Money Laundering Reporting Officer and a named Practice Assurance compliance principal, both able to explain the firm’s procedures without reaching for a folder
• CPD records kept as they happen, not reconstructed retrospectively from memory and old calendar invites

None of this is complicated. What it needs is the same thing most operational gaps in a growing practice need: one named owner, a place these things live, and a slot in an existing routine where someone checks them — the same discipline covered in how to build SOPs in an accountancy practice.

Why this is a COO problem, not a compliance-afternoon problem

Most practices already have someone responsible for AML and quality on paper — usually a partner, doing it alongside a full chargeable workload, which means it gets the attention that is left over after client work. That is exactly the pattern that produces an eighteen-month-old risk assessment: not neglect, just a genuine job with no dedicated time competing against jobs with client deadlines attached.

A fractional COO does not replace the Money Laundering Reporting Officer or the compliance principal — those are named regulatory roles and stay with the partners who hold them. What changes is that reviewing and re-issuing these documents becomes a standing line in the firm’s monthly operating review rather than a task that only resurfaces when a pre-review call puts a date on it. That is the same operating discipline described in what is operating discipline — a rhythm that catches the drift before it becomes a finding, rather than a scramble that fixes the symptom once the reviewer has already flagged it. It is one of the smaller, quieter things the Optivo Monthly COO keeps on a checklist, precisely because nobody else in the practice has capacity dedicated to noticing it has gone stale.