Why ASIC's REP 842 still shows an audit judgement gap

The Australian Securities and Investments Commission (ASIC) has put preparers and auditors on notice that financial reporting quality still falls short where the numbers depend on professional judgement, and Report 842 (REP 842), published on October 29, 2026, is the surveillance record behind that judgement.

From July 1, 2025 to June 30, 2026, ASIC reviewed 353 financial reports and 25 audit files at 12 firms, up from 15 files a year earlier, per REP 842 and media release 26-260MR. Section 307A of the Corporations Act 2001 requires those audits to follow the auditing standards. The 42 findings on 15 company comment forms, set against peer supervisors and the sanctions already entered, show what that surveillance year changed.

Key facts

• ASIC reviewed 353 financial reports for years ending June 30, 2024 to December 31, 2025: 311 company reports and 42 registrable superannuation entity (RSE) reports, with surveillances of 30 companies (REP 842, October 29, 2026).
• The audit sample was 25 files at 12 firms, against 15 files in 2024–25, covering 13 ASX-listed companies, six large proprietary companies and six RSEs (REP 842, section 1).
• Company work produced 15 comment forms and 42 findings at 11 firms: 17 audit findings and 25 other findings, with remedies proposed for every audit finding and for 23 of the 25 other findings (REP 842, section 5).
• Sixteen companies changed, or agreed to change, 20 areas, including 10 operating-review upgrades under section 299A (REP 842, Table 4).
• Since July 1, 2025, ASIC has acted against 16 auditors, three directors and 57 companies, including infringement notices of A$9.5 million (Australian dollars) to 49 companies and court penalties above A$1.6 million (REP 842, section 6).
• Section 311 notifications rose from 696, covering 740 contraventions in 2024–25, to 3,341, covering 3,487 contraventions in 2025–26, and more than 85% concerned failure to lodge (REP 842, section 7).

Methodology and sources

The primary documents are REP 842, ASIC’s oversight of financial reporting and audit 2025–26, and media release 26-260MR of October 29, 2026. Where the two differ in precision, the PDF controls. Surveillance ran from July 1, 2025 to June 30, 2026, on reports with years ending from June 30, 2024 to December 31, 2025. The account relies on ASIC’s published findings rather than a re-performance of any audit. An independent external panel reviewed the drafts. Comparison documents are the Financial Reporting Council (FRC) announcement of July 22, 2026, the Public Company Accounting Oversight Board (PCAOB) staff Spotlight of March 31, 2025, and Accounting and Corporate Regulatory Authority (ACRA) materials current to October 28, 2026. Related coverage sits on the regulation desk.

Related:CFTC sues Utah to defend exclusive event-contract jurisdiction

What the Corporations Act requires when the file turns on judgement

Chapter 2M of the Corporations Act 2001 is the spine of the surveillance. Sections 296 and 297 require accounting-standard compliance and a true and fair view, section 299A adds the operating and financial review for listed entities, and section 295(3A)(a) adds the consolidated entity disclosure statement for public companies. Opinion duties sit in sections 307 and 308, auditing standards apply through section 307A, and section 307C requires an independence declaration. Suspected contraventions go to ASIC under section 311. Regulatory Guide 34, reissued on September 18, 2025, tells auditors how to make that report.

An ASIC audit finding, as REP 842 defines it, is a conclusion that the auditor lacked reasonable assurance the financial report as a whole was free of material misstatement, because auditing standards were missed and the opinion rested on an insufficient basis. The label stops short of declaring the accounts themselves materially misstated. For the year to June 30, 2026, ASIC recorded 17 audit findings and 25 other findings across 15 comment forms sent to auditors at 11 firms. Six audit findings sat in revenue and receivables, five in impairment and asset values, two in investments and financial instruments, and four in employee benefits, provisions, leases and inventory. ASA 230 paragraph 8(c) requires the file to record significant professional judgements, and ASA 540 requires a test of how management made an estimate and a record of possible bias. REP 842’s criticism is that challenges to discount rates, forecasts and recoverability were thin or missing at Deloitte, Ernst & Young, KPMG, PricewaterhouseCoopers (PwC), BDO and Grant Thornton.

Inquiries to 30 companies produced changes, or agreements to change, at 16 companies across 20 areas. Ten areas were operating and financial review risk disclosures under section 299A and Regulatory Guide 247. Viva Energy Group recognised an impairment of A$558.8 million on retail convenience sites after ASIC questioned the cash-generating unit under AASB 136, of which A$25 million followed from testing sites individually, announced on April 13, 2026. Pure Foods Tasmania reduced deferred tax assets by A$4.5 million after five years of losses, announced on April 24, 2026, against AASB 112 paragraphs 34 and 36.

"Getting these areas right is essential to providing investors with information they can rely on. Auditors need to be independent, obtain stronger evidence, challenge management assumptions and document their conclusions."

— Kate O'Rourke, Commissioner, Australian Securities and Investments Commission (ASIC media release 26-260MR, October 29, 2026)

How four supervisors grade the same estimate risk

Sources: REP 842, the FRC announcement of July 22, 2026, the PCAOB release of March 31, 2025, and ACRA’s programme page together with the orders list, last checked on October 30, 2026.

ASIC’s company audit sample and a PCAOB Part I.A rate answer different questions. REP 842 reviewed 19 company audit files at 12 firms in 2025–26: six after a financial reporting concern, three after an independence concern, and 10 at random, inside a listed population of about 1,800 entities and about 2,800 registered company auditors. Fifteen of those 19 files drew a comment form. The PCAOB staff Spotlight of March 31, 2025 reported a Part I.A deficiency rate of 39% for 2024 inspections, down from 46% in 2023, and 20% at the Big Four US firms, which at December 31, 2024 audited about 80% of listed US market capitalisation. Under the Sarbanes-Oxley Act of 2002, a Part I.A finding means the firm lacked sufficient appropriate evidence for its opinion. The FRC review of July 22, 2026 pairs file inspection with a systems grade and describes public-interest-entity quality as broadly stable.

Of the 19 company files, four closed with zero findings and 15 drew a comment form, mixing 17 opinion-basis failures with 25 lesser findings. Thirteen files sat with Deloitte, Ernst & Young, KPMG, PwC, BDO and Grant Thornton, all six of which self-assessed against Report 817 in 2025–26 and committed to a root-cause review plus a wider independence sweep.

"Audit quality and trust in the audit sector are fundamental to well-functioning markets and confidence in the UK economy. Reliable audits support informed decision-making, strengthen accountability and underpin sustainable growth. The FRC's report helps users of audits make better decisions and enriches conversations with audit firms by providing a balanced assessment of audit quality."

— Anthony Barrett, Executive Director of Supervision, Financial Reporting Council (FRC news, July 22, 2026)

That balanced assessment is the serious counterpoint to a deficits-only reading of REP 842. From April 2026 the FRC graded systems alongside files at its 12 largest firms, while ASIC still withholds a single deficiency percentage and will test whether the next impairment memo has changed.

Enforcement that now sits beside the file review

Financial reporting and auditor misconduct are enforcement priorities for 2026. Since July 1, 2025 ASIC has acted against 16 auditors, three directors and 57 companies, including Federal Court proceedings against three auditors and two authorised audit companies. The Companies Auditors Disciplinary Board (CADB) cancelled two registrations and suspended one. Court penalties exceeded A$1.6 million, and late-lodgement infringement notices total A$9.5 million across 49 companies.

The pleading closest to the judgement findings is against Auditeo Australia Pty Ltd and auditors Ajm Didarul Islam Khan and Brian Robert Taylor, announced on July 31, 2026, alleging missed reasonable steps to keep First Guardian Master Fund audit reports free of material falsity or misleading content. Any penalty awaits the Federal Court. In July 2026 the Court found former Noumi chief executive Rory Macleod in breach over inventory and lactoferrin revenue recognised before delivery. Appendix 1 also lists December 22, 2025 proceedings against BDO Audit and director Dean Just.

On March 17, 2026 the Downing Centre Local Court fined Urban Ecological Systems Limited A$240,000, Invitrocue Limited A$530,000 and Boyuan Holdings Limited A$400,000, a combined A$1,170,000, including breaches of sections 319(1) and 1311(1). On July 21, 2026 it fined Hudson Global Resources (Aust) Pty Ltd A$270,000 for missing audited reports for 2022, 2023 and 2024. The wider penalty year is covered in the account of the A$830 million enforcement year.

Nexia Perth Audit Services Pty Ltd paid an A$78,250 infringement notice on October 1, 2025 over an alleged prohibited non-assurance service under APES 110. Payment leaves guilt and liability unadmitted. Appendix 1 also records Hall Chadwick undertakings, a December 18, 2025 CADB cancellation across 10 listed audits, Cameron Bradley’s September 15, 2026 suspension, and the October 9, 2026 dismissal of Reginald Lance Williams’ appeal. Benjamin Peters’ registration ended on October 23, 2026 after a file surveillance. Other settlement practice is in the note on US, UK and Australian enforcement settlements.

What this means for directors, auditors, licensees and funds

Directors receive each company comment form and the auditor’s response under Regulatory Guide 260. The demand is a position paper tying the judgement to a standard: AASB 136 paragraphs 33, 66 and 80 on cash-generating units, and section 299A plus Regulatory Guide 247 on risks specific to the business.

Auditors proposed fixes for all 17 audit findings and for 23 of 25 other findings. Among the six largest firms, Table 7 counts 10 actions in the current period, 33 in the subsequent period and 28 file-specific steps. The coming year asks for evidence or a dated commitment, and section 50C(1) of the ASIC Act allows a deficiency report where that remedial action remains outstanding. Revenue, impairment and financial instruments are on the focus list issued on May 18, 2026, so an unchanged memo will be visible on the next file.

Three files were selected for independence, and on each the judgements were thinly documented. Deloitte’s large-proprietary audit had run for over 15 years, with a former partner as secretary and chief financial officer since 2022–23. Grant Thornton had kept the same lead partner for over 10 years. PwC’s listed audit had run for over 25 years, with a former partner chairing the audit committee. REP 842 restates the five-out-of-seven-year cap on a significant role, and APES 110 section 540 adds a seven-year key-partner cap.

Nine trustees were questioned on valuations, with the detail in Report 841, and schemes join the next sample after the June 18, 2026 private-credit note. Lodgement failures account for 3,007 of 3,487 section 311 contraventions to June 30, 2026. ASIC records limits on action against a partnership, as distinct from the signing auditor. The CFD order extension is a different surveillance tool, and the SEC order on broker-dealer audit tagging shows file rules moving outside Australia too.

What the next surveillance year will test

ASIC will read at least 200 company reports, 20 RSE reports and 20 scheme reports, focusing on revenue, impairment, financial instruments and AASB 137 decommissioning provisions. The audit sample stays at 25 files: 17 companies, four RSEs and four schemes. Firms with a 2025–26 comment form will be asked for evidence of the fix. A complaints surveillance at the four largest firms has started, alongside a project on auditors who miss section 1287A statements, report zero audit work for five years, or leave levies unpaid.

Naming a firm while withholding the company may change audit-committee behaviour, or it may only move embarrassment inside the partnership, and ASIC has again withheld a rate comparable with the PCAOB’s 39%. Action against the partnership remains limited, so the six-firm self-assessment cycle is a substitute for a statutory firm licence. The FRC systems model and ACRA’s section 38(2) order power are the nearest designs, and ASIC has pointed to the government for anything between them.

TL;DR

REP 842, published by ASIC on October 29, 2026, covers surveillance from July 1, 2025 to June 30, 2026. ASIC read 353 financial reports and 25 audit files at 12 firms, and issued 15 company comment forms containing 42 findings to auditors at 11 firms. Seventeen findings go to the opinion, clustered where ASA 230 and ASA 540 require management’s assumptions to be challenged on the file. Sixteen companies changed, or agreed to change, 20 reporting areas. The six largest firms face a remediation clock tied to Report 817, with section 50C of the ASIC Act if fixes stay outstanding. Those 42 findings are a risk-based yield, a poor stand-in for PCAOB and FRC market-wide rates, and they now sit beside A$9.5 million in lodgement infringement notices issued to 49 companies.

Frequently asked questions

What does REP 842 cover in the latest surveillance year?

REP 842 is ASIC’s 2025–26 oversight report, published on October 29, 2026. It covers 353 financial reports, 311 company reports and 42 registrable superannuation entity reports, plus 25 audit files at 12 firms. Company work is the core: 30 financial reporting surveillances and 19 audit files, 15 of which produced a comment form. Superannuation findings sit mainly in Report 841, and 40 sustainability reports sit in Report 839. Surveillance ran from July 1, 2025 to June 30, 2026.

How many audit findings did ASIC record on the company files?

ASIC issued 15 comment forms carrying 42 findings to auditors at 11 firms. Seventeen are audit findings, meaning reasonable assurance that the report was free of material misstatement was lacking. Twenty-five are other findings, sent to the auditor and the directors where that misstatement risk was assessed as contained. Six concerned revenue, five impairment, two financial instruments, and four provisions, leases and inventory. Four of the 19 company files closed with zero findings. A Regulatory Guide 260 comment form is separate from a CADB order or a court fine.

Which firms were reviewed, and which six must self-assess?

The 19 company files covered 12 firms, including BDO, Deloitte, Ernst & Young, Grant Thornton, KPMG and PwC, with three files each at KPMG and PwC. Those six, the largest in REP 842’s definition, self-assessed against Report 817 and were asked to deepen the plans. All six committed to firm-wide communication, a root-cause review, a wider independence sweep and extra training. Four undertook to fix firm-specific findings. ASIC has reserved judgement on whether the plans change the next engagement file, and it will test that in the coming surveillance year.

Which enforcement results does the report place beside the surveillance?

Since July 1, 2025 ASIC records action against 16 auditors, three directors and 57 companies. Auditeo proceedings announced on July 31, 2026 allege failures on First Guardian Master Fund, with any penalty still before the Federal Court. Companies paid A$9.5 million across 49 infringement notices. Three public companies were fined a combined A$1,170,000 on March 17, 2026, and Hudson Global Resources (Aust) Pty Ltd was fined A$270,000 on July 21, 2026. In July 2026 the Court found former Noumi chief executive Rory Macleod in breach over inventory and revenue.

How does ASIC’s file review compare with the FRC, the PCAOB and ACRA?

ASIC names firms and splits audit findings from other findings, and it withholds a single deficiency percentage. The PCAOB staff Spotlight of March 31, 2025 put the 2024 Part I.A rate at 39%, down from 46%, and the Big Four US rate at 20%. The FRC review of July 22, 2026 pairs inspections with a systems grade and calls public-interest-entity quality broadly stable. Singapore can order a hot review, a restriction or cancellation under section 38(2) of the Accountants Act, in force since July 1, 2023.

What will ASIC examine in the coming surveillance year?

ASIC will read at least 200 reports of listed, public and large proprietary companies, plus 20 superannuation reports and 20 scheme reports, and 25 audit files split as 17 companies, four RSEs and four schemes. Revenue, impairment, financial instruments and AASB 137 provisions are the focus. Promised fixes face section 50C if remedial action stays outstanding. A complaints review at the four largest firms is underway, as is a project on auditors who miss section 1287A statements or report zero audit work for five years.

This article is informational analysis only and does not constitute legal, regulatory, tax, or investment advice. Regulatory frameworks change frequently and interpretation depends on facts and circumstances; primary documents and official regulator guidance always supersede summaries. Firms should consult qualified legal counsel and their relevant supervisory authority before taking any action based on the analysis above.