Audit regulation hasn’t kept pace with conduct of large firms

In its submission to Treasury’s consultation on regulating accounting, auditing, and consulting firms in Australia, the Super Members Council (SMC) said a series of regulatory reviews, parliamentary inquiries, and surveillance activities have raised concerns about audit quality, accountability, and governance.

Together, these reviews showed that while individual auditors are well regulated, many factors that drive audit quality are determined at the firm level. Here, the submission pointed out that regulatory oversight and accountability are “insufficient”.

“These recent scandals and reviews paint a clear picture that Australia’s regulatory framework has not kept pace with the scale, complexity and conduct of large audit, accounting and consulting firms,” the submission read.

It further said that audit firms operate as critical gatekeepers for the super system, as their work supports the reliability of information that super funds use to invest retirement savings and gives assurance of the funds’ own regulated reporting obligations. It added that rigorous audit tests go beyond financial statements for super funds.

Alongside this, they also examine compliance frameworks, unit pricing frameworks, risk management frameworks, internal control design, and operational effectiveness.

“When audits are not rigorous enough, practical harms can follow. They provide an independent examination of funds risk functions, operational processes and financial and investment systems,” the submission read.

More robust consequences needed

As such, the SMC has made seven recommendations centred on strengthening audit quality, accountability, and market confidence.

It has recommended that Treasury support stronger disciplinary processes and sanctions, including civil penalties and enhanced ASIC administrative powers. This measure is to combat misconduct in a “timely, credible, and proportionate” way at both the individual and firm level.

It said the framework should enable ASIC and relevant disciplinary bodies to respond effectively to misconduct, require remediation where suitable, and act against both individuals and firms where the relevant conduct or governance failure occurs at the firm level.

“Disciplinary and penalty settings must be strong enough to ensure audit firms and auditors do not treat noncompliance as a cost of doing business,” the submission read.

“Penalties should reflect the seriousness of conduct that undermines audit integrity, confidence in financial reporting and trust in Australia's regulatory framework.

“In SMC’s view, stronger disciplinary processes and sanctions are a necessary complement to reforms aimed at improving audit accountability and governance. Without credible consequences for misconduct or governance failures, reforms to audit governance and accountability will not deliver the confidence in financial reporting, market integrity and regulatory oversight that those reforms are intended to achieve.”

Strengthened governance at large firms

Another recommendation is stronger governance requirements for large audit firms, including a board responsible for decision-making, strategic direction and oversight, independent board members, and governance accountabilities for key personnel responsible for running the firm, similar to directors’ duties under the Corporations Act.

“Large audit partnerships perform a significant public interest function but have historically had considerable discretion to design their own governance frameworks,” the SMC said.

“That discretion is no longer sufficient for firms whose audit work underpins confidence in financial reporting, capital markets and the super system.”

Similar governance requirements have improved other regulated sectors like banking, insurance, and super where APRA standards require sound governance frameworks, independent leadership, and audit and risk committees, the SMC said. These standards support prudent management, stronger risk oversight, and public confidence in institutions with important public functions. These same principles apply to large audit firms, it added.

“Clearer boards, independent oversight, and duties for those running audit firms would align their governance more closely with the entities they audit and make responsibility for audit quality, independence, conflicts and resourcing more visible and accountable,” the submission read.

At the KPMG ethics and accountability public hearings in August, former chairman Martin Sheppard acknowledged a “difficult tension” between partner-directors and independent directors on the firm’s board, and said there is no framework for governance partnership.

In addition, the SMC recommended operational separation and stronger conflict controls within multidisciplinary firms where audit and non-audit services sit together so that audit quality and independence are protected from broader commercial pressures.

“Information obtained or developed through an audit engagement should be used only for the purpose of performing that audit, and not for unrelated commercial, consulting, product development, data analytics or other business purposes without clear authority,” the submission read.

“Clear authority should simply not be a waiver included in standard terms included in a contract or agreement, but be specific to the information to be used, and its purpose. Confidential audit data should not be used to gain commercial leverage in other functions of an accounting firm conglomerate.”

The sharing of confidential information was one of the central issues explored at the KPMG hearings. It was revealed that former KPMG Australia chief operating officer Eileen Hoggett emailed her personal assistant about confidential documents relating to the Lendlease audit, which were kept in a locker at KPMG Sydney’s office.

The hearings also uncovered attempts by former partner Kim Lawry to downplay her taking photographs of confidential documents by saying she did not recall being aware they were confidential.