UK regulators, standards-setters and company law explained (ICO, FRC, CIPFA, Companies Act)

UK organizations answer to a mix of regulators, standards-setters and statutes. This guide gives a plain definition of the Public Sector Internal Audit Standards, CIPFA and the ICO first, then the practical detail on what each means for compliance, audit and governance teams. It also covers the FRC and the Companies Act 2006, which sit alongside them.

What are the Public Sector Internal Audit Standards?

The Public Sector Internal Audit Standards (PSIAS) are the standards that set out how internal audit should be carried out in UK public sector bodies. They define the purpose of internal audit, the code of ethics auditors follow and the practices for planning, performing and reporting audit work. They were based on the Institute of Internal Auditors (IIA) international standards and first applied from April 2013.

Who PSIAS applies to

• Central government departments and their agencies
• Local authorities, including councils and fire and police bodies
• NHS bodies
• Other public bodies that follow government or local government audit rules

What PSIAS covers

Area	What it sets out
Mission and definition of internal audit	The purpose of internal audit as independent, objective assurance and advice
Code of ethics	Integrity, objectivity, confidentiality and competency
Attribute standards	Purpose, authority and responsibility, independence, proficiency and quality
Performance standards	Managing the audit function, planning, engagements, communicating results and monitoring progress
Quality assurance and improvement	Internal assessments and an external assessment at least every five years

PSIAS and the Global Internal Audit Standards

The IIA published new Global Internal Audit Standards, effective from January 2025. In the UK public sector, these replace the PSIAS from April 2025, supported by an application note that adapts them for public sector use. Public sector internal audit teams should check the current guidance from their sponsoring body and the application note for the latest position.

What internal audit teams need to do

• Keep an internal audit charter that sets out purpose, authority and reporting lines
• Plan audit work from a risk-based plan approved by the board or audit committee
• Report independently to the audit committee
• Keep evidence of how each engagement was planned, performed and reviewed
• Run a quality assurance and improvement program, including external assessment
• Show conformance with the standards in the annual internal audit opinion

Evidence is the pressure point. Auditors need working papers, findings and actions in a form they can show to an assessor. Ideagen Internal Audit supports risk-based planning, workpaper management, action tracking and reporting for public sector teams, and its documentation and audit trails help teams show conformance with the standards.

What is CIPFA?

CIPFA is the Chartered Institute of Public Finance and Accountancy. It is a UK professional body for people working in public finance, and it also sets standards and guidance for how public money is managed. It was founded in 1885 and its members work in local government, central government, the NHS, education and the wider public sector.

What CIPFA does

• Trains and qualifies public finance professionals
• Publishes codes and guidance for public sector finance and governance
• Provides advice, benchmarking and research to public bodies
• Works with the IIA and government bodies on internal audit standards in the public sector

CIPFA codes and guidance public bodies use

Document	What it is for
Code of Practice on Local Authority Accounting	Sets out the accounting and reporting requirements for local authority accounts
Prudential Code for Capital Finance	Guides local authority borrowing and capital investment decisions
Treasury Management Code	Guides how local authorities manage cash, borrowing and investments
Financial Management Code	Sets standards of financial management and sustainability
Statement on the Role of the Head of Internal Audit	Sets out the role, status and expectations of the head of internal audit

CIPFA has also worked with the IIA on the standards that govern public sector internal audit, so many internal audit teams use CIPFA guidance alongside the standards themselves. Which CIPFA documents apply depends on the type of body and the nation of the UK, so check the requirements for each organization.

Audit teams that need to show alignment with CIPFA guidance have to link each requirement to evidence and actions. Ideagen Internal Audit helps public sector teams keep that record in one place and report to audit committees.

What is the ICO?

The ICO is the Information Commissioner's Office, the UK's independent regulator for data protection and information rights. It upholds information rights in the public interest, promotes openness by public bodies and protects personal data. It is led by the Information Commissioner and reports to Parliament.

What the ICO regulates

Law	What it covers
UK GDPR and Data Protection Act 2018	How organizations collect, use, store and share personal data
Privacy and Electronic Communications Regulations (PECR)	Electronic marketing, cookies and similar technologies
Freedom of Information Act 2000	Public access to information held by public authorities
Environmental Information Regulations 2004	Public access to environmental information
Other laws	Areas such as electronic identification and trust services

What the ICO does

• Gives guidance and advice to organizations and the public
• Handles complaints from people about how their data has been used
• Investigates breaches and failures to comply
• Takes enforcement action, including warnings, reprimands, enforcement notices and fines
• Runs the data protection fee system for organizations that process personal data

For the most serious breaches of UK GDPR the ICO can fine up to 17.5 million pounds or 4% of worldwide annual turnover, whichever is higher. Reforms to UK data protection law may change how the ICO is structured and governed, so check current ICO guidance.

What organizations should do to stay on the right side of the ICO

• Know what personal data you hold and why, and keep records of processing
• Publish clear privacy notices
• Have a process for access and other individual rights requests
• Keep security measures proportionate to the risk
• Report notifiable personal data breaches to the ICO within 72 hours of becoming aware of them
• Pay the data protection fee where it applies
• Train staff and review policies on a set schedule

Privacy law changes, and ICO guidance changes with it. Teams need a way to track those changes and link them to the policies and processes they affect. Ideagen's regulatory compliance solution helps teams track regulatory updates and see which policies need review, which supports the monitoring side of data protection compliance. Legal and privacy teams still decide how each rule applies.

What is the FRC?

The FRC is the Financial Reporting Council, the UK regulator for auditors, accountants and actuaries. It also sets the UK Corporate Governance Code and the Stewardship Code. Its aim is to promote transparency and integrity in business and to support investor confidence.

• Sets standards for auditing, accounting and actuarial work
• Publishes the UK Corporate Governance Code, which listed companies apply or explain why they do not
• Publishes the UK Stewardship Code for investors
• Supervises audit quality and takes enforcement action against auditors and accountants
• Monitors the quality of corporate reporting

Proposed reforms would replace the FRC with a new regulator, the Audit, Reporting and Governance Authority, but timing depends on legislation. Check the current position before relying on this section.

What is the Companies Act 2006?

The Companies Act 2006 is the main piece of UK company law. It sets out how companies are formed, run, reported on and wound up, and it defines the legal duties of company directors.

What it covers

Area	What it sets out
Company formation and structure	Types of company, articles of association and company names
Directors' duties	Duties to act within powers, promote the success of the company, exercise independent judgment, use reasonable care, avoid conflicts of interest and not accept benefits from third parties
Accounts and reports	Annual accounts, directors' reports and strategic reports
Audit	Which companies need an audit and the role of auditors
Filing and registers	Filing requirements with Companies House and statutory registers
Shareholder rights	Meetings, resolutions and shareholder protections

Breaches can lead to fines, director disqualification and personal liability in some cases. Companies House filing deadlines and requirements change, so check current guidance.

How the regulators and standards fit together

Body or law	Type	Main focus
PSIAS and Global Internal Audit Standards	Standards	How internal audit is carried out
CIPFA	Professional body and standards-setter	Public finance, governance and audit practice
ICO	Regulator	Data protection and information rights
FRC	Regulator and standards-setter	Audit, accounting, corporate governance and stewardship
Companies Act 2006	Statute	Company structure, directors' duties and reporting

Frequently asked questions

What are the Public Sector Internal Audit Standards in simple terms?

They are the rules for how internal audit should work in UK public sector bodies, covering ethics, independence, planning, reporting and quality.

Do PSIAS still apply?

The Global Internal Audit Standards replace PSIAS in the UK public sector from April 2025, with an application note for public sector use. Check the guidance from your sponsoring body.

What is CIPFA in simple terms?

It is the UK professional body for public finance. It trains people, publishes codes and guidance and supports good financial management in public services.

What is the ICO in simple terms?

It is the UK regulator for data protection and information rights. It gives guidance, handles complaints and can fine organizations that break the law.

What is the difference between the ICO and the FRC?

The ICO regulates data protection and information rights. The FRC regulates auditors, accountants and actuaries and sets the corporate governance and stewardship codes.