Key takeaways
- Where the AFM, FRC, and PCAOB expectations diverge from what audit teams deliver, with specific ISA paragraph references
- Why internal quality reviews consistently miss deficiencies that external inspectors catch
- How to identify the expectation gap in your own files before an inspector does
- What concrete changes to working paper documentation close the gap most efficiently
What regulators expect vs what they find
The expectation gap is not abstract. It maps to specific ISA requirements where regulators consistently find that audit teams meet the letter of the standard but miss the intent. Here are the four areas ranked by frequency of inspection findings across the AFM, FRC, and PCAOB.
Professional scepticism: what regulators expect
ISA 200.15 defines professional scepticism as an attitude that includes a questioning mind, being alert to conditions that may indicate possible misstatement, and a critical assessment of audit evidence. Regulators interpret this as active challenge, not passive receipt. The FRC’s 2024 Annual Enforcement Review identified failure to exercise professional scepticism as a recurring theme in enforcement cases.
What regulators find instead: audit teams that accept management’s explanations and representations without documenting what alternative explanations were considered and rejected. The AFM’s inspections found that in 45% of reviewed audits, auditors did not obtain sufficient appropriate audit evidence. Many of those deficiencies traced back to accepting management’s position on a judgment area without challenging the underlying assumptions.
The gap in the file
Regulators expect to see: “Management represented that the provision is adequate because of X. We considered whether Y or Z might be more appropriate because of [evidence obtained during fieldwork]. We concluded X is reasonable because [reasoning].”
What they find: “Management represented that the provision is adequate. We concur.”
Accounting estimates: what regulators expect
ISA 540.13 requires the auditor to obtain an understanding of how management made the accounting estimate, including the methods, assumptions, and data used. The expectation goes beyond understanding. ISA 540.18 requires the auditor to assess the reasonableness of the estimate.
The FRC’s inspection reports identify the audit of judgements and estimates as one of the two most common deficiency areas alongside going concern. The PCAOB’s 2024 inspection spotlight reported improvements but noted that estimates remained a high-deficiency area, particularly for revenue-related estimates and business combinations.
What regulators find: auditors who review management’s methodology without testing whether the assumptions are supportable. The AFM has noted that auditors on non-PIE engagements frequently accept management’s estimates at face value when the client is a long-standing audit client with historically accurate estimates. Past accuracy does not eliminate the need to test current-period assumptions. ISA 540.A11 explicitly warns against this.
Documentation: what regulators expect
ISA 230.8 sets the standard: documentation sufficient to enable an experienced auditor having no previous connection with the audit to understand the nature, timing, and extent of procedures performed, the results, and the conclusions reached. Regulators apply this standard literally. If the reasoning isn’t in the file, it doesn’t exist for inspection purposes.
The gap here is often described by inspectors as “the file shows what was done but not why.” ICAS’s summary of FRC Tier 2 and Tier 3 findings noted that quality control weaknesses (shortcomings in partner and EQR reviews) were contributory factors, suggesting that incomplete documentation passes through multiple review layers undetected.
What regulators find: working papers that document procedures performed and results obtained, but omit the auditor’s evaluation of those results and the reasoning behind the conclusion. This is particularly common on going concern (ISA 570), impairment (IAS 36), and expected credit loss calculations (IFRS 9).
Going concern: what regulators expect
ISA 570.16 requires the auditor to evaluate management’s assessment of going concern. As covered in depth in the AFM ISA 570 findings post, regulators expect independent stress testing, documented conclusions with reasoning, and explicit evaluation of “close call” situations.
The FRC found going concern deficiencies in 38% of Tier 2 and Tier 3 inspected files. Every one of those findings was rated as requiring improvements or significant improvements. The deficiency rate has barely moved year on year: the FRC’s previous report found 37%.
Why internal reviews miss what inspectors catch
The PCAOB’s 2024 inspection results showed an overall Part I.A deficiency rate of 39% across all inspected firms. At Big Four US firms, the rate was 20%. At non-affiliated firms inspected triennially, the rate was 61%. These are files that passed the firms’ own quality review processes.
Two structural differences between internal reviews and external inspections explain the gap.
Internal reviews are calibrated to the firm’s own methodology. If the firm’s going concern template asks four questions and the audit team answered all four, the internal reviewer rates the file as acceptable. An external inspector applies ISA 570.16 directly and asks whether the four questions actually covered the requirements. If the template doesn’t prompt the auditor to perform an independent stress test, the firm’s own review will never flag its absence.
Internal reviewers share the same time pressure and incentive structure as the audit teams. The AFM’s report on internal quality reviews (IQRs) noted significant variation in IQR quality across firms. Large firms with formalised IQR processes caught more issues. Small and mid-sized firms with informal IQR policies caught fewer. The AFM’s 2025 State of the Industry report found that only 28% of small and medium-sized non-PIE firms had written root cause analysis policies. Without written policies, learning from past deficiencies depends on individual memory rather than institutional process.
The decision framework: which files are at risk
Not every file is equally exposed to the expectation gap. The risk concentrates in specific combinations of engagement characteristics and audit areas.
If your engagement has any of the following four characteristics, the expectation gap is likely present in the file.
- The entity is in a sector with volatile margins or significant estimation uncertainty (construction, real estate, hospitality, retail, technology start-ups). Regulators select these engagements for inspection at a higher rate because they contain the judgment areas where scepticism failures are most consequential.
- The entity has been your audit client for more than five years. Long-tenure engagements generate familiarity. The FRC’s thematic review of professional scepticism (published 2022) found that auditors on long-tenure engagements were less likely to challenge management. The IESBA Code Section 540 requires you to evaluate familiarity threats, but many files contain no documented evaluation.
- Management’s accounting estimates have been historically accurate. When management’s prior-year estimates prove correct, auditors reduce their challenge of current-year estimates. ISA 540.A11 warns against this explicitly, but the incentive runs in the opposite direction.
- The file passed the firm’s internal quality review without findings. This sounds counterintuitive, but files that internal reviewers rate as acceptable may be the ones most likely to contain the deficiencies inspectors flag, precisely because the internal review missed them.
If your engagement has none of these characteristics, the expectation gap is lower. A straightforward manufacturing entity in year two of the audit tenure, with limited estimation complexity, presents fewer judgment areas where scepticism failures can occur. Regulators will still inspect these files, but the deficiency rate is lower.
Worked example: rewriting a file section to meet regulator expectations
Dekker Bouwgroep B.V. is a Dutch mid-market construction company with €63M revenue and €41M in fixed-price contracts. The engagement is in its seventh year. The 2024 file contained a going concern working paper that the firm’s internal reviewer rated as acceptable. You are reviewing the file against regulator expectations before the 2025 audit begins.
What the 2024 file contained
The going concern working paper included management’s board paper with a base-case cash flow forecast, a memo stating that the forecast was reviewed and inputs were traced to the trial balance, and a one-line conclusion: “No indicators of material uncertainty identified. Going concern basis appropriate.”
What an inspector would flag
No independent stress test. The two largest fixed-price contracts (combined €27M) were not evaluated against cost-to-complete estimates. No documentation of why the auditor concluded that no material uncertainty existed despite the entity operating in a sector with volatile margins. A 10% cost overrun on those two contracts was never modelled. Going concern conclusions were not communicated to the audit committee.
How to rewrite for the 2025 audit
Step 1: Evaluate management’s base case (ISA 570.16(b))
Don’t trace inputs to the trial balance and stop. Challenge the revenue assumptions. Compare projected margins to the trailing four-year average. Identify the two contracts with the highest cost uncertainty. Test the cost-to-complete estimates against project manager reports and client correspondence.
Record your evaluation of each significant assumption. For each assumption, note what evidence supports it and what contradicts it. File the contradictory evidence alongside the supporting evidence.
Step 2: Build an independent downside scenario
Model a 15% cost overrun on the two largest fixed-price contracts. Combine this with a 30-day delay in receivable collection. Assess whether the entity can meet its obligations for twelve months under this scenario.
File the independent model. Label it clearly as the auditor’s scenario, not management’s. Record the outcome and its impact on the going concern conclusion.
Step 3: Write the conclusion as reasoning, not a statement
Replace “No indicators of material uncertainty identified” with: “We identified the following ISA 570.A3 indicators: declining operating margins (from 3.8% to 2.1% over four years), concentration of fixed-price contract risk (two contracts representing 66% of the backlog), and receivable ageing increasing from 48 days to 67 days. We evaluated these indicators against management’s base-case forecast and our independent stress test. Under the base case, the entity meets its obligations with adequate headroom. Under our downside scenario (15% cost overrun on the two largest contracts plus a 30-day receivable delay), the entity’s cash position would decline to approximately €1.4M but would remain positive throughout the forecast period. Based on this evaluation, we conclude that no material uncertainty exists but that the indicators identified warrant disclosure of principal risks in the financial statements.”
That paragraph takes ten minutes to write. It converts a one-line template conclusion into a documented judgment that an inspector can evaluate.
Practical checklist
- Compare your firm’s going concern template to ISA 570.16 directly. Does the template prompt the auditor to perform an independent stress test, or only to review management’s assessment? If the template doesn’t require it, add it before the next audit cycle.
- After your internal quality review, select two files rated “acceptable” and apply the six-point inspector checklist from the AFM ISA 570 findings post. Record any deficiencies your IQR missed.
- For every accounting estimate above performance materiality, document what alternative assumptions you considered and why you concluded management’s assumptions were reasonable (ISA 540.18).
- On engagements in year five or later, document your evaluation of familiarity risk. If you don’t document it, an inspector will assume you didn’t perform it.
- Write ISA 570 conclusions as paragraphs of reasoning. Eliminate template phrases (“no indicators identified”) that don’t explain the basis for the conclusion.
- Review the FRC’s “What Makes a Good Audit” publication and the AFM’s most recent reports on audit quality before each audit cycle begins. Regulators publish what they look for. Use it.
Get practical audit insights, weekly.
No exam theory. Just what makes audits run faster.
No spam — we're auditors, not marketers.
Related tools and reading
Put audit concepts into practice with these free tools:
Related guides:
Frequently asked questions
What are the four areas where the audit expectation gap is widest?
The gap is widest in professional scepticism on management’s representations, independent evaluation of accounting estimates (ISA 540.13), documentation of the auditor’s own reasoning (ISA 230.8), and going concern assessment rigour (ISA 570.16). These four areas generate the most frequent inspection findings across the AFM, FRC, and PCAOB.
Why do internal quality reviews miss deficiencies that external inspectors catch?
Two structural differences explain the gap. Internal reviews are calibrated to the firm’s own methodology and templates, so if the template doesn’t prompt an independent stress test, the reviewer won’t flag its absence. Second, internal reviewers share the same time pressure and incentive structure as audit teams. The AFM found that only 28% of small and medium-sized non-PIE firms had written root cause analysis policies.
What does the documentation gap look like in practice?
Regulators expect to see the auditor’s reasoning, not just procedures performed. They expect something like: “Management represented X. We considered Y and Z as alternatives because of [evidence]. We concluded X is reasonable because [reasoning].” What they find: “Management represented X. We concur.”
Which engagement characteristics indicate higher expectation gap risk?
Four characteristics indicate higher risk: the entity operates in a sector with volatile margins, audit tenure exceeds five years creating familiarity risk, management’s accounting estimates have been historically accurate, and the file passed internal quality review without findings.
How can auditors close the expectation gap efficiently?
Write ISA 570 conclusions as paragraphs of reasoning rather than template phrases. For every accounting estimate above performance materiality, document alternative assumptions considered. Compare your firm’s templates to ISA requirements directly rather than relying solely on internal review processes. These changes often take only minutes per file but convert template conclusions into documented judgments.
Source references
- FRC, 2024 Annual Enforcement Review
- FRC, 2022–23 Inspection Report on Tier 2 and Tier 3 Firms
- FRC, Thematic Review of Professional Scepticism, 2022
- AFM, 2025 State of the Industry report
- PCAOB, 2024 Aggregate Inspection Results
- ISA 200, Overall Objectives of the Independent Auditor
- ISA 230, Audit Documentation
- ISA 540 (Revised), Auditing Accounting Estimates and Related Disclosures
- ISA 570 (Revised), Going Concern