In short. A good going-concern file is six things, in order: the period assessed, the cash and liquidity baseline, the regulatory and capital baseline, the management forecast, the stress, and the conclusion. Each section is two to four pages. The file is forty to fifty pages total. A regulator can read it cold in forty minutes and reach the same conclusion as the engagement partner. That is the test.

1. Why the area is rewritten so often

ISA (UK) 570 was revised in September 2019 in response to a series of high-profile corporate failures where the going-concern conclusion turned out to be wrong, or right but indefensible, or right but where the file did not show the working. The revisions made the auditor’s responsibilities more explicit, particularly around the rigour of management’s assessment, the auditor’s separate evaluation, and the disclosures in the auditor’s report when material uncertainty exists.

Since 2019 the FRC has issued repeated thematic feedback on going-concern audit quality. The recurring observations are not about conclusion accuracy. They are about file architecture: insufficient documentation of the auditor’s separate evaluation, inadequate evidence around the stress testing, weak articulation of why the period assessed was appropriate, and disclosure narratives that do not match the underlying assessment.

The result is that going-concern is now the area audit firms rewrite most often during a file review, and the area where engagement teams report the most uncertainty about what good looks like. This note is an attempt at an answer.

2. The period assessed

ISA 570 paragraph 13 requires the auditor to evaluate management’s assessment of the entity’s ability to continue as a going concern, covering at least twelve months from the date of approval of the financial statements. The minimum twelve months is, in practice, almost never adequate.

The period assessed should align with the entity’s strategic horizon, regulatory cycle, and major operational events. For a UK bank, the operative period is usually fifteen to eighteen months, capturing the next ICAAP submission and the next supervisory engagement. For an insurer, the period typically extends to the next regulatory reporting milestone. For a fintech, the period is often two years, capturing the next equity round.

The file needs to state, in one paragraph at the front of the going-concern memorandum, what period has been assessed and why. The justification is normally three or four sentences. The absence of this paragraph is one of the most common findings in inspection feedback, because the alternative — an implicit twelve-month assessment — reads as default rather than judgment.

3. The cash and liquidity baseline

The first substantive section after the period justification is the cash and liquidity baseline. This is the part of the file that should be drafted from primary data — bank statements, treasury position, available facility headroom — rather than from management commentary.

A clean cash and liquidity baseline contains:

  • Period-end cash position by entity and by currency, reconciled to bank statements and counterparty confirmations.
  • Available undrawn facility headroom at period end and at the date of audit opinion, with covenant headroom calculated.
  • Liquidity coverage ratio (where regulated) and the trend over the prior twelve months.
  • Maturity profile of debt instruments falling due within the assessment period, including refinancing assumptions.
  • Cash-flow forecast for the assessment period, in a separate workpaper but referenced here.

This baseline is largely deterministic. It does not require judgment beyond defining the right scope. It is where workpaper-generation tooling earns its keep, because the work is the same shape every time and the discipline that makes it defensible is consistency rather than insight.

4. The regulatory and capital baseline

For FCA or PRA regulated entities, the regulatory baseline is separate from the financial baseline and equally important. The going-concern conclusion cannot stand if the entity’s regulatory position is at risk within the assessment period, regardless of how strong its cash position is.

The regulatory baseline workpaper covers:

  • Current capital adequacy against the regulatory minimum, with the buffer expressed in both percentage and absolute terms.
  • Stressed capital adequacy against the most recent ICAAP/ICARA result, with the date and conclusion of the latest supervisory feedback.
  • Liquidity adequacy against the LCR and any internal liquidity stress.
  • Pillar 2 capital add-ons and any supervisory expectations communicated within the prior twelve months.
  • Open supervisory matters including S166 reviews, thematic reviews where the entity is in scope, and any S77 notifications.
  • Resolution position for in-scope entities, referencing the most recent resolvability assessment.

The reason to separate this from the cash and liquidity baseline is that the failure modes are different. A regulated entity can be cash-positive and still face a going-concern threat from a Pillar 2 add-on it cannot meet, or from a supervisory direction it cannot satisfy. The file should make these distinct dimensions visible.

5. The management forecast

This section is where most going-concern files become unreadable. The temptation is to reproduce the management forecast in full, in spreadsheet form, with extensive commentary. The result is a thirty-page section that no reviewer reads end to end.

The discipline is to summarise rather than reproduce. The forecast section should contain:

  • The headline numbers — revenue, operating expenses, EBITDA, capital and liquidity ratios — for each year in the assessment period.
  • The key assumptions — growth rates, cost inflation, margin assumptions, regulatory capital evolution — presented in a table.
  • The internal consistency check showing that the forecast is consistent with the strategy paper approved by the board.
  • The auditor’s evaluation, in one paragraph, of whether each key assumption is reasonable in light of historical evidence and current conditions.

Full forecast workings live in a separate appendix that the file references but does not embed. The summary in this section is two to three pages. The reader leaves it with a clear sense of what management expects to happen, not with a faithful reproduction of the model.

6. The stress: where most files lose the most credibility

Stress testing is the section that, when done well, makes the file. When done badly, it makes the conclusion look inevitable in a way that reads as confirmation bias.

A defensible stress workpaper contains three scenarios, not one. The single-stress approach — where management has run one stress and the file evaluates only that one — is a recurring inspection finding because it fails to demonstrate the auditor’s independent challenge.

The three scenarios are typically:

  • Management’s base stress, as run for ICAAP/ICARA or for board reporting. The file evaluates whether the severity is plausible.
  • The auditor’s severe-but-plausible stress, calibrated independently. The severity is typically one notch worse than management’s base, calibrated to specific historical precedents or to the relevant supervisory severity benchmark.
  • The reverse stress, which asks what combination of events would cause the entity to fail. This is sometimes called a break-the-bank stress. It does not require that the events be plausible; it requires that they be identified. The reverse stress is the workpaper that most clearly demonstrates the auditor has thought about the boundary of going concern rather than just confirmed the inside of it.

Each stress is evaluated for cash, regulatory, and operational sustainability. The conclusion section of the stress workpaper states which scenarios the entity survives, which it does not, and what mitigating actions management has identified and how plausible those actions are.

7. The mitigating actions

This is the part of going-concern files that has degraded most across the audit profession in the last five years. The mitigating actions section often reads as a list of management aspirations rather than as a set of actions that have been evaluated for feasibility.

A defensible mitigating-actions workpaper covers, for each action:

  • What the action is, in specific operational terms.
  • What time is required to execute it.
  • What dependencies it has (board approval, counterparty agreement, regulatory non-objection).
  • Whether the action has been executed before, by this entity or by a comparable one.
  • What evidence exists that the dependencies can be satisfied within the required time.
  • The auditor’s conclusion on plausibility.

Generic mitigations — “raise additional capital”, “defer capital expenditure”, “reduce variable costs” — are not mitigations. They are categories within which actual mitigations live. A file that lists categories rather than actions has not done the work.

8. The conclusion

The going-concern conclusion is one of three:

  • No material uncertainty, where the assessment, evidence, and stress testing collectively support a conclusion that the entity is a going concern.
  • Material uncertainty exists, where the auditor concludes the entity is a going concern but draws attention to factors that may cast significant doubt. This triggers a Material Uncertainty Related to Going Concern paragraph in the auditor’s report under ISA 570 paragraph 22.
  • Going-concern basis not appropriate, the rarest conclusion, where the auditor concludes that the financial statements should not be prepared on a going-concern basis.

The conclusion is one paragraph in the going-concern memorandum, signed by the engagement partner, that references the previous sections of the file and states the basis. It is rarely longer than half a page. The brevity is the point: the conclusion is supposed to be the place where everything else in the file lands.

9. The disclosure consistency check

The going-concern disclosure in the financial statements has two versions: the narrative in the strategic report (typically the going-concern statement made by directors) and the accounting policy note (typically the going-concern statement made in the financial statements themselves). Both must be consistent with the auditor’s file.

The disclosure consistency workpaper, like the IFRS 9 disclosure workpaper, takes every assertion in the directors’ going-concern statement and every assertion in the financial-statement note and ties each back to the underlying assessment. The work is mechanical; the absence of it is a recurring finding.

10. The forty-minute test

The way I evaluate the quality of a going-concern file before issue is to ask whether someone who has never met the engagement team, given the file and forty minutes, could (a) reach the same conclusion and (b) explain to a regulator why the conclusion is correct. If the answer is no, the file is incomplete, regardless of how many pages it contains. If the answer is yes, the file is complete, regardless of how few.

Forty minutes covers six sections at roughly seven minutes each: period, cash, regulatory, forecast, stress, conclusion. The forty-five-page file described in this note distributes its volume across those sections in proportions of roughly fifteen, fifteen, twenty, twenty, twenty, and ten percent. Any file that is heavier than this on management commentary and lighter than this on the auditor’s independent evaluation has the proportions backwards.

11. Closing observation

Going-concern is the audit area where the gap between conclusion and evidence is most visible, because the conclusion is binary and the evidence is documentary. Every other significant audit area can hide weakness in technical complexity; going-concern cannot. A weak going-concern file is identifiable in twenty minutes by anyone with audit experience.

The good news is that going-concern is also the audit area where structural improvement yields the most disproportionate gain. A firm that adopts the file structure described above in one cycle will produce demonstrably better files in the next cycle, in less senior time, with materially less rewriting. The discipline is the file architecture, not the analytical work, which is mostly already being done in someone’s head and just needs the place in the file where it visibly belongs.

— DK Buledi, February 2026