Brazil’s Securities and Exchange Commission, known as the CVM, has identified an awkward problem in the country’s audit industry: the person tasked with reviewing the auditor appears to almost never challenge the auditor. Based on its supervisory and enforcement experience, the regulator says it is “extremely rare, if not virtually nonexistent” to find quality reviewers asking for additional evidence, questioning conclusions or recommending changes to the work they review.
The finding appears in an annual circular issued by the CVM’s accounting and auditing supervision arm to independent auditors registered with the regulator. Dated September 2 and officially released on Thursday, September 3, the document highlights issues the CVM has identified through its supervisory and inspection work. According to the regulator, the purpose is to improve the quality of audits across Brazil’s capital markets.
This is not a new rule created from scratch. Rather, the circular is a regulatory message about how existing standards should be applied — and, more importantly, about the shortcomings the CVM says it has been finding in practice. This year’s document covers auditor independence, audit documentation, investment funds, quality controls and assurance over sustainability disclosures. One of its most pointed conclusions is that internal quality reviews within audit firms may be functioning largely as a formality.
A quality reviewer is, in effect, an auditor of the auditor. The reviewer does not need to redo the entire audit, but is expected to assess the team’s most significant judgments, determine whether the evidence supports its conclusions, and test whether independence and professional skepticism have been preserved. If problems arise, the reviewer is expected to challenge the engagement partner — and, in some cases, the audit report cannot be finalized until those disagreements are resolved.
That is why the CVM’s diagnosis matters. Based on the audits it has inspected, the regulator says quality reviews tend to be “merely formal,” often amounting to little more than sign-offs and review passwords rather than an independent exercise of professional judgment. A mechanism designed to challenge the auditor therefore risks simply validating the work it was supposed to test.
That goes to the economic heart of auditing. Companies and investors are not paying merely for a signature at the bottom of a set of financial statements. They are paying for an architecture of controls, segregation of duties and independent checks intended to reduce the risk of error, complacency and conflicts of interest. If the second line of review becomes little more than a rubber stamp, part of the value of that architecture disappears.
There is also an incentive problem. Audit firms are private businesses that sell services, compete for clients and cultivate long-term commercial relationships. The quality reviewer exists precisely to introduce tension into that system: someone who did not perform the work must be willing to ask whether the conclusions are wrong. A process in which almost nobody challenges anybody may be efficient at getting reports signed. It is less effective at finding problems.
The CVM is now warning that this may go beyond weak governance. The circular explicitly raises the possibility that failures to comply with professional obligations could lead to administrative enforcement. Perhaps that is the clearest way to understand the regulator’s message: the quality reviewer is not there to prove that the auditor was right. The role exists to increase the chances of finding out when the auditor is wrong.
Leave a Reply