The relationship between auditors, companies and regulators has always involved a degree of tension. Auditors work closely with management but must remain independent of it. They must understand management’s judgements, while retaining sufficient professional scepticism to challenge them. And they must exercise professional judgement in circumstances where the significance of a decision may only become apparent years later. The Australian Securities and Investments Commission (ASIC) has released its latest report on its oversight of financial reporting and audit for 2025–26. It puts those tensions back into focus.

The significance for auditors goes beyond regulatory compliance. ASIC's scrutiny is also a reminder that audit judgements can assume much greater significance if the underlying financial reporting is later challenged.

When a company subsequently fails, restates its accounts or writes down the value of an asset, decisions made during the audit may be reconstructed in a very different environment. Questions that seemed capable of reasonable professional judgement at the time may later be examined by regulators, liquidators, shareholders and courts with the considerable advantage of hindsight.

Against that background, there is an important distinction between having undertaken an audit process and being able to demonstrate why a particular audit judgement was reasonable based on the information available at the time it was made. That distinction is becoming increasingly important.

From audit quality to broader accountability

ASIC’s continuing focus on audit quality reflects the central role auditors play in the integrity of financial markets. But regulatory scrutiny of an audit rarely takes place in isolation. There will often be an underlying event which brings the financial statements, and ultimately the audit, into question: a corporate collapse, impairment, unexpected loss, restatement or allegation that the market received inaccurate financial information.

Attention then moves backwards through the chain of decision-making:

• What information was available to management?
• What assumptions underpinned the relevant accounting treatment?
• What information was provided to the auditor?
• What information did the auditor independently obtain?
• Was there evidence inconsistent with management’s position?
• How was that evidence evaluated?
• Were assumptions sufficiently challenged?
• What was communicated to the board or audit committee?
• What does the contemporaneous audit file reveal about that process?

Those questions can be significant not only to ASIC’s supervision of audit quality, but also to subsequent questions of liability.

As a result, the same circumstances can potentially generate several forms of exposure:

• regulatory scrutiny of the company and its directors
• scrutiny of the auditor’s compliance with its professional and statutory obligations
• private litigation.

While these forms of exposure arise under different legal and regulatory frameworks, the same underlying facts and contemporaneous records may be relevant to each.

Professional scepticism cannot be reconstructed later

One of the difficult aspects of an auditor’s role is that many of the issues most susceptible to later challenge are precisely those that require judgement rather than mechanical verification.

Asset valuations are an obvious example. Forecast revenue, discount rates, expected cash flows and assumptions about future market conditions may all be matters on which professional opinions can differ. There will not necessarily be a single objectively correct answer available at the time.

That has an important consequence when an audit is subsequently examined. The relevant question should not simply be whether an assumption ultimately proved to be correct. An assumption can prove wrong without having been unreasonable when it was made. The more important question is likely to be whether a sound, evidence-based process supported the conclusion, having regard to the information available at the time.

That is where professional scepticism becomes critical. Scepticism is not demonstrated simply by asking management questions. The more difficult issue is what the auditor did with the answers. Where assumptions were material, the auditor should be able to demonstrate the evidence supporting them, how contrary evidence was identified and whether alternative scenarios were considered. If management’s position was accepted, the audit file should demonstrate why it was accepted and perhaps most importantly, the reasoning that supported that conclusion.

More documentation is not necessarily the answer

The instinctive risk-management response to regulatory scrutiny can be to demand more documentation. That may miss the point. A voluminous audit file does not necessarily demonstrate a high-quality audit. Nor can documentation created after an issue has crystallised substitute for the professional scepticism that should have been applied while the audit was being undertaken.

From a regulatory and litigation risk perspective, the more useful objective is contemporaneous documentation that explains the reasoning behind important decisions. There is an important difference. A file which records that management’s assumptions were reviewed and considered reasonable tells a future reader comparatively little. A file which identifies the significant assumptions, records the evidence for and against them, explains how contradictory information was addressed and demonstrates why the auditor ultimately accepted the position is substantially more useful.

That matters from an audit-quality perspective. It may matter even more if the audit file is subsequently examined in a regulatory investigation or legal proceeding.

Independence also matters in substance

The same observation applies to independence. Auditors necessarily develop close working relationships with companies and management teams. Those relationships can be commercially important and professionally productive. But familiarity creates its own risks.

The issue is not simply whether formal independence requirements have been satisfied. A regulator or court examining an audit after the event may be interested in whether the auditor was sufficiently independent in substance to challenge management when necessary. That makes the quality of the relationship particularly important. An effective auditor cannot approach the engagement as an adversary of management. Equally, maintaining the relationship cannot become more important than challenging an assumption which requires challenge.

For boards and audit committees, this is relevant too. Auditor independence should not be regarded simply as a compliance matter to be dealt with through an annual declaration. The nature of the relationship between management and the auditor, including its capacity to accommodate robust disagreement, is part of effective governance.

The problem of hindsight

The greatest practical difficulty for auditors is often hindsight. Consider a hypothetical example in which an asset is valued at $200m and is subsequently impaired to $100m. Viewed retrospectively, the earlier valuation may immediately attract attention. But the later impairment does not, of itself, establish that the original valuation was unreasonable or that the audit was deficient. What becomes critical is the information available at the earlier point in time. That includes the forecasts and risks known at that time, the alternative valuations considered, any contradictory information, the degree of uncertainty surrounding the assumptions and the information provided by management and obtained independently by the auditor.

The discipline for auditors is therefore to ensure that the contemporaneous file permits that earlier decision to be evaluated using information available at the time, rather than through the lens of what happened later.

That distinction can be decisive when audit judgements become the subject of regulatory investigation or litigation.

Audit committees should take notice too

There is also a lesson for directors and audit committees. Robust challenge from an external auditor should not necessarily be viewed as friction in the relationship. Quite the opposite. An auditor who presses management on valuation assumptions, requests additional evidence or raises uncomfortable questions may ultimately be strengthening the position of the company and its directors as well as protecting the integrity of the audit.

The quality of the auditor-management relationship should therefore not be measured by the absence of disagreement. A healthier measure may be whether the relationship permits difficult issues to be identified, debated and resolved without compromising the auditor’s independence or professional scepticism.

What should auditors take from ASIC’s scrutiny?

ASIC’s findings, viewed through a regulatory and litigation risk lens, highlight four practical lessons.

The audit file as evidence

There is a broader point in all of this. An audit file serves an immediate professional purpose: recording the work undertaken and supporting the audit opinion. But when things go wrong, its function changes.

Years later, the file may become the principal contemporaneous record of what the auditor knew, what the auditor questioned and why the auditor reached the conclusion it did. At that point, the quality of the reasoning recorded in the file can be as significant as its completeness.

ASIC’s continuing scrutiny of financial reporting and audit therefore provides an important context for auditors considering their broader regulatory and litigation exposure. Good audit practice and good risk management increasingly point in the same direction:

• independently test significant assumptions
• identify contradictory evidence
• exercise genuine professional scepticism
• leave a contemporaneous record that explains not merely what conclusion was reached, but why.

If an audit judgement is challenged years later, the auditor may no longer be explaining it just to an audit committee. They may be explaining it to ASIC or to a court.

Our team advises auditors, companies and directors on regulatory investigations and disputes arising from audit and financial reporting issues. Contact us to discuss these issues.