Major audit firms still need independent scrutiny

8 November 2026 · Public regulatory findings

Your programme has a board, an internal assurance team and external auditors. Does that mean you are safe? Not by itself. The useful question is what each layer actually checks, what evidence it sees and whether someone can challenge the answer.

When the dashboard is green, what does that status prove? Does the board see unresolved risks, or only a confident summary? Across private companies and public bodies, published findings show why reputation and layers of oversight cannot replace effective scrutiny. The cases below have different causes and responsibilities; they are not evidence that every assurance provider failed in every case.

And whose confidence is at stake? Customers, residents, investors, employees and the wider public may rely on different promises, but all have an interest in honest reporting. Weak assurance can put trust and reputation at risk alongside money and services. How would you rebuild that trust if confident assurances proved unreliable?

If a major firm is involved, who challenges its work?

Four selected published UK Financial Reporting Council (FRC) cases illustrate why even major firms need scrutiny. These findings concern specific firms and financial-statement audit engagements, not every member of an international network or all of their work.

Grant Thornton UK LLP: Patisserie Holdings Plc

On 27 September 2021, the FRC announced a £4 million financial sanction, adjusted and discounted to £2.34 million, against Grant Thornton UK LLP for its audits of Patisserie Holdings Plc for the financial years ended 30 September 2015, 2016 and 2017. The firm and engagement partner accepted failures concerning revenue, cash, journals and fixed asset additions. The FRC identified failures in professional scepticism, audit evidence and documentation. It also imposed a severe reprimand and non-financial measures, including additional monitoring of bank and cash audit work. The FRC recognised exceptional co-operation and remedial action.

FRC announcement, 27 September 2021.

PricewaterhouseCoopers LLP (PwC): BHS and Taveta

On 12 June 2018, the FRC announced a £10 million fine, reduced by 35% to £6.5 million for early settlement, against PwC in relation to the 2014 audits of BHS and the Taveta Group. PwC and the engagement partner admitted misconduct. The published particulars identify failures including insufficient professional scepticism and audit evidence concerning management's use of the going-concern assumption. The sanctions included a severe reprimand, monitoring of the Leeds Audit Practice and an undertaking to strengthen engagement quality-control reviews for specified high-risk or high-profile audits.

FRC announcement, 12 June 2018; FRC published particulars of facts and misconduct (PDF).

Deloitte LLP: Autonomy Corporation Plc

On 17 September 2020, the FRC announced that an independent Disciplinary Tribunal had imposed a £15 million fine on Deloitte, together with a severe reprimand, following findings of misconduct concerning Autonomy's published financial reporting for periods between January 2009 and June 2011. The findings included insufficient professional scepticism and audit evidence concerning hardware sales and sales of software licences to value-added resellers. Deloitte agreed to provide a root-cause analysis. This was a contested tribunal decision, not an admission-based settlement; the announcement does not describe the £15 million as a discounted settlement amount.

FRC announcement, 17 September 2020; FRC publication of the tribunal report, 6 January 2021.

Ernst & Young LLP (EY): Stagecoach Group plc

On 25 August 2021, the FRC announced a £3,500,000 financial sanction, reduced by 10% for mitigating factors and then by 30% for admissions and early disposal to £2,205,000, against Ernst & Young LLP for its statutory audit of Stagecoach Group plc's consolidated financial statements for the year ended 29 April 2017. The admitted failings concerned defined-benefit pension obligations, accident-related insurance claim provisions and an onerous contract provision for the East Coast Mainline franchise. The FRC identified insufficient evaluation and challenge of expert work and management assumptions, insufficient audit evidence and professional scepticism, and inadequate documentation.

The FRC did not allege that the financial statements were actually misstated, and said the breaches were not intentional, dishonest, deliberate or reckless. It acknowledged remedial action and co-operation. EY also received a severe reprimand and a requirement to report for one year on audit work relating to onerous contract provisions. This is a specific audit-quality case, not a finding against EY's worldwide network or a measure of programme failure.

FRC announcement, 25 August 2021.

What happens when oversight exists, but risks remain?

Birmingham City Council: ERP and public accountability

The Commissioners' report dated 31 January 2025 described an Oracle reimplementation programme that had stabilised but remained fragile, while identifying continuing governance and cultural weaknesses. The Council's public notice of 20 February 2025 confirmed that Grant Thornton UK LLP had issued a public interest report on the ERP implementation, with learning points for the Council to consider. These are public records of programme and governance scrutiny, not a regulatory finding that the Council's external auditor committed misconduct or received a fine. If a programme needs recovery, who tests whether governance changes actually work, rather than simply exist on paper?

Commissioners' second report, 31 January 2025 (PDF); Council public notice, 20 February 2025. These dated assessments are not a statement of the programme's current status.

Enron: who challenges conflicts and the board itself?

In its 8 July 2002 report on Enron's collapse, the US Senate Permanent Subcommittee on Investigations found that the board permitted high-risk accounting, inappropriate conflicts of interest and undisclosed off-the-books activity. It also found that the board failed to ensure its auditor's independence. This is a historical example of board oversight and independence failures, not a claim about today's firms. Who checks that a supposedly independent voice is independent in practice?

US Senate report, 8 July 2002.

Barings: was the warning acted on?

The Reserve Bank of Australia's November 1995 account of the Barings inquiry described inadequate separation between trading and back-office functions in Singapore, ambiguous oversight and internal-audit recommendations not acted on quickly enough, or at all. It also described shortcomings in supervisory arrangements. The lesson is not merely to commission a review: who owns each action, and what evidence proves that the weakness is closed?

Reserve Bank of Australia, November 1995; original Board of Banking Supervision report, 18 July 1995.

A US public body: an audit is not a clean opinion

A US Government Accountability Office report published 21 August 2025 and publicly released 28 August 2025 recorded that the Department of Defense's fiscal year 2024 auditor reported 28 material weaknesses in internal control over financial reporting. These contributed to the Department's inability to obtain an audit opinion. This is an example of auditors identifying limitations and weaknesses, not evidence that the auditors failed or that those weaknesses represent a quantified loss. How does leadership turn findings into demonstrable remediation, rather than another open-action list?

GAO-25-108145, August 2025. This describes fiscal year 2024, not later audit results.

Who assures the assurance?

What does management own? What does internal assurance test? What does the external auditor's opinion cover, and what lies outside it? Boards and audit committees need to scrutinise scope, independence, evidence and follow-through; independent review and regulatory oversight provide further challenge within their respective remits. No single layer removes the responsibilities of the others. Protecting confidence means being clear about what is known, what remains uncertain and who is accountable for acting.

What this means for programme governance

Financial-statement audit is not ERP or programme assurance: their objectives, scope and professional responsibilities differ. These fines are regulatory sanctions, not estimates of client losses or measures of programme failure rates. These historical UK cases do not establish the quality of other engagements or services in other countries.

The transferable governance lesson is to ask for evidence, not rely on reputation. Boards and programme sponsors should test who provides challenge, how independence is protected, what evidence supports progress and readiness, and how unresolved risks reach decision-makers. For distributed or multi-country programmes, make ownership, dependencies and escalation routes explicit across teams.

Independent programme assurance can provide an additional perspective on scope, budget, schedule, controls and delivery confidence. It does not replace statutory audit, local legal or regulatory advice, or management accountability, and it cannot guarantee that failures will be prevented.

Would an independent view help you test the story behind your programme reports? I bring 29+ years of finance transformation and assurance experience to focused health checks, readiness reviews and ongoing programme challenge. We can agree a scope around the decisions you need to make and the evidence you need to trust. Talk to Ru about your programme; enquiries are welcome worldwide.

Explore programme assurance · Oracle ERP assurance · All insights