Investors see the auditor’s opinion, but rarely the evidence and professional judgements behind it. Their confidence in financial reporting therefore depends not only on the auditor’s independence, but also on whether the audit work can withstand independent scrutiny. This raises a question central to market confidence. Who checks whether the auditor has obtained sufficient appropriate evidence to support the opinion expressed?
This is the purpose of what is sometimes called “auditing the auditor”. The phrase does not mean repeating an audit or assuming auditors cannot be trusted. It refers to independent oversight of how audits are conducted, the evidence supporting audit opinions and the systems designed to maintain audit quality.
Importantly, this oversight does not involve examining every audit engagement annually. The Audit Oversight Board (AOB) inspects major audit firms each year, while other firms are inspected at least once every five years, based on risk considerations. Within this programme, selected engagements are reviewed to assess compliance with auditing standards and whether sufficient appropriate audit evidence was obtained to support the auditor’s opinion. The AOB also examines firms’ quality management systems, making oversight relevant to both the individual audit and the environment in which it is conducted.
Malaysia established the AOB on April 1, 2010, under the Securities Commission Malaysia Act 1993. Its mandate is to promote confidence in the quality and reliability of audited financial statements, particularly those of public interest entities and schedule funds. Its responsibilities include registration, inspections, guidance and enforcement. The AOB’s 2025 inspection results show both progress and the need for continued attention. It inspected 14 audit firms, 40 individual auditors and 41 audit engagements. The proportion of inspected engagements requiring significant improvements fell from 46% in 2024 to 27% in 2025. This is encouraging, although recurring deficiencies remained in accounting estimates, sampling, internal control testing and revenue recognition. These findings are not a verdict on every audit or auditor. They identify areas where audit practices and quality management can be strengthened.
Malaysia’s enforcement record also illustrates what independent oversight means in practice. In March 2024, the AOB publicly reprimanded Nexia SSY PLT and two audit partners. Among the findings, the engagement partner had not obtained sufficient evidence to support the basis for a qualified audit opinion, while the engagement quality control reviewer had not sufficiently reviewed documentation relating to significant judgements and risk areas.
In October 2024, the AOB prohibited an audit partner from Morison Anuarul Azizan Chew from accepting or auditing public interest entities and schedule funds for one year and imposed a RM87,500 fine. The partner had failed to obtain sufficient audit evidence in key areas of group financial statements, including cash and bank balances, prepayments and investments.
In June 2025, Chengco PLT’s registration was suspended for two years following serious audit quality deficiencies across several engagements. The findings included insufficient evidence in areas such as bank borrowings, revenue, cost of sales and going concern assessments, as well as weaknesses in engagement quality reviews. Some deficiencies were recurring despite an earlier sanction in 2019.
Oversight also protects auditor independence. In August 2024, the AOB fined Grant Thornton Malaysia PLT RM150,000 and an audit partner RM37,500 for breaches of key audit partner rotation requirements. Such safeguards matter because confidence depends not only on the evidence gathered, but also on the independence of those evaluating it.
The significance of these cases lies not in naming and blaming firms, but in understanding what oversight is designed to protect. It examines the sufficiency of audit evidence, the quality of professional judgement, the effectiveness of review procedures and compliance with independence requirements. Where serious deficiencies persist, enforcement provides accountability.
Corporate governance is central to this framework. Management prepares the financial statements. The board and audit committee oversee the reporting process and the external auditor. The auditor provides independent assurance, while the AOB oversees auditors within its remit. Each has a distinct responsibility. Effective governance depends on these responsibilities working together, rather than simply existing on paper.
The oversight challenge is also evolving. Artificial intelligence is changing how audit firms analyse documents, identify patterns and support audit procedures. These tools may improve efficiency, but they raise questions about data security, system reliability and the quality of evidence produced. Technology does not remove the need for professional scepticism or the responsibility to obtain sufficient appropriate evidence. Independent oversight can help ensure that innovation is supported by sound governance, controls and professional judgement.
Ultimately, audit quality is not produced by the external auditor alone. It depends on reliable information from management, informed scrutiny by audit committees, effective quality management within audit firms, professional standards and independent regulation. No single part can substitute for the others.
As business risks and audit methods evolve, independent oversight must keep pace. Its purpose is not to undermine auditors, but to reinforce the standards, accountability and professional discipline on which reliable assurance depends.
Ultimately, public confidence in financial reporting requires more than an auditor’s opinion. It requires confidence in the process that supports it. Even watchdogs need to be watched. That is how accountability protects trust.
Hijat A Jabbar is a professor of accounting at Universiti Utara Malaysia’s Kuala Lumpur campus.