ICAS Practice Monitoring: what a Scottish accountancy firm’s visit actually checks

What an ICAS Practice Monitoring visit actually is

Practice Monitoring is ICAS’s own quality-assurance regime for member firms holding a practising certificate — required for a sole practitioner, a partner in a partnership, a member of an LLP, or a director of a company providing accountancy services to the public. The scheme’s own stated purpose is to reassure the public and other regulators that ICAS firms are complying with the Public Practice Regulations, relevant legislation and best practice, and ICAS describes the visits themselves as consultative and helpful rather than prescriptive — a reviewer there to test whether the firm’s systems work, not to catch it out.

The scope is general practice: anti-money-laundering procedures, client money handling, engagement letters, complaints handling, professional indemnity cover and the firm’s own quality-control arrangements. Audit work and insolvency work are carved out deliberately and monitored under their own separate regimes — a registered auditor firm also sits on a statutory audit-monitoring cycle, reviewed on its own timetable with its own reviewer, and an insolvency practitioner is monitored separately again. A firm that does all three can, in principle, face three different ICAS reviews on three different clocks, which is itself worth knowing before the first letter arrives rather than after.

How firms are selected — and why there is no safe number of years

This is the point where ICAS’s regime genuinely diverges from ICAEW’s Practice Assurance, which guarantees every registered firm a backstop visit at least once every eight years regardless of risk score. ICAS Practice Monitoring has no published equivalent backstop for the general (non-audit) regime. Selection instead runs on two tracks at once: risk factors — information in the firm’s own annual return, findings carried over from a previous visit, or a referral from an ICAS committee — sitting alongside a random element drawn from the entire population of ICAS practising firms.

The practical consequence is that “we were visited three years ago, so we’re not due again for a while” is not a safe assumption under this regime the way a rough mental countdown might be under a fixed-cycle scheme. A firm can be drawn again the following year purely by the random element, with a spotless record and nothing in its annual return to flag. Visits are mostly carried out on site, though ICAS does run desktop — remote — reviews for smaller or less complex firms, and either way the reviewer tests the effectiveness of the firm’s systems directly rather than simply reading a policy document and taking it on trust.

A worked example: the random draw

Picture an eight-partner firm in Edinburgh, nothing in its history to suggest a problem — no matters raised at its last visit six years ago, a clean annual return, no complaints on file. It is drawn anyway, purely as part of that year’s random sample. The notification gives a few weeks’ notice and a list of what the reviewer will want to see: the firm-wide AML risk assessment, a sample of client due diligence files, the engagement letter template in current use, the complaints procedure, and evidence of how often the firm’s own internal quality-control checks actually run.

The AML risk assessment on file is two years old, written before the firm took on a cluster of property-development clients with a materially different risk profile from its existing base. In practice that single gap is enough to turn what should have been a quiet visit into a finding: not because the firm lacks a risk assessment, but because the one it has no longer describes the firm it has become. The managing partner updates it before the reviewer leaves, which closes the immediate point, but the report still records that the document was not being kept current — and a firm that gets the same observation again at its next visit, on whatever date the random draw lands on, is a firm whose paperwork is treated as something you write once rather than something you own.

What ‘good’ looks like between visits

Because there is no reliable years-since-last-visit countdown to plan against, the only dependable defence is a firm that keeps the underlying material current as a matter of routine, not one that performs well under notice:

• A firm-wide AML risk assessment reviewed at least annually, and re-issued the moment the client base, services or geography genuinely changes — not held over until the next scheduled review date
• Client due diligence evidence held on file for a sample the firm could produce today, not reconstructed from memory under a deadline
• An engagement letter template that is actually re-issued to existing clients when scope or fees change, with evidence that it happened
• A written complaints procedure every member of staff can point to, not just the partner who drafted it
• A record of the firm’s own internal quality-control checks actually running on the frequency the firm says they do, rather than a policy describing a check nobody has performed this year
• One named person who can produce all of the above inside a day, because under a random-selection regime that day could be any day

None of this is complicated, and none of it requires specialist compliance knowledge — it requires the same discipline covered in how to build SOPs in an accountancy practice: a named owner, a place these documents live, and a slot in an existing routine where someone actually checks them against how the firm operates today, rather than how it operated when the document was first written.

Why this is a COO problem, not a compliance-afternoon problem

Most Scottish practices already have a partner responsible for AML and quality, doing it alongside a full chargeable workload — which is exactly how a two-year-old risk assessment happens. It is rarely neglect; it is a real job competing for time against jobs with client deadlines attached, in a firm with no random-selection notice period to force the issue until the letter actually lands.

A fractional COO does not take on the Money Laundering Reporting Officer role or sign the risk assessment — those stay with the partner who holds them by registration. What changes is that reviewing and re-issuing these documents becomes a standing line in the firm’s monthly operating review, on the same cadence regardless of whether a visit is announced, rather than a task that only gets attention once a reviewer has put a date on it. That is the same rhythm described in what is operating discipline — and under a regime with a random element rather than a fixed countdown, it is the only version of “ready” that actually holds up. It is one of the quieter items the Optivo Monthly COO keeps on a running checklist, precisely because a firm with no dedicated operations capacity has nobody else whose job it is to notice the paperwork has drifted.