Tilsynsrapport og vedtak - ES Revisjon AS

The regulator found the firm failed to design and perform audit procedures addressing fraud risk and revenue recognition, did not apply sufficient professional scepticism, and failed to obtain adequate audit evidence. It also identified a multi-year failure to conduct satisfactory cyclical engagement quality controls. For compliance teams, this reinforces that audit quality is not just a technical requirement but a supervisory priority.

Firms should immediately review their fraud risk assessments, revenue testing and scepticism documentation; strengthen engagement quality control reviews; and ensure audit files demonstrate challenge and corroboration. Audit committees should ask auditors how they address fraud and revenue risks and how quality controls are monitored. While the penalty is directed at a Norwegian audit firm, the underlying themes—professional scepticism, fraud risk, revenue audit and quality control—are globally relevant and mirror UK and EU regulatory expectations.

Risks include increased supervisory scrutiny, reputational damage, client loss and potential follow-on claims. Opportunities exist for firms with robust audit quality frameworks to differentiate themselves and for governance teams to enhance auditor oversight. Firms with cross-border Norwegian exposure should assess whether similar deficiencies exist in their own engagements.