OKB: Going Deeper

SUPERVISION VISUAL SUMMARY Going Deeper In short The AFM concludes that the Engagement Partner Quality Review (EPQR) must be improved to guarantee the quality of statutory audits. In particular, the depth of the EPQR must be improved. This report contains the main findings, enhancements, and some good practice examples. We have already discussed the research results extensively with the sector.

External Auditor and Audit Team Audit File 4 Audit Report Annual Accounts Public € The EPQR reviewer conducts the EPQR. Important elements for an EPQR are: Accounting Organizations 3 1 2 Depth Expertise Involvement EPQR Reviewer Accounting Organizations With a regular license (AO's-RV) With an OOB license (AO's-OOB) 13 of 15 1 of 6 Quality management system for EPQR not in order for AO's-RV. 1 2 5 of 30 0 of 22 Appropriate EPQR reviewer expertise not established for AO's-RV. 3 Timely involvement of the EPQR reviewer is important. 4 26 of 30 9 of 22 Depth of assessment by the EPQR reviewer must be better for AO's-RV and AO's-OOB.

Going Deeper 2 SUPERVISION REPORT

1. Introduction 1 https://www.afm.nl/nl-nl/sector/actueel/2021/december/accountants-iko-grip-op-kwaliteit. 2 Article 18 of the Decision on Supervision of Accounting Organizations and Article 8 of the EU Regulation on specific requirements for the statutory audit of financial statements of entities of public interest. The AFM investigated the Engagement Partner Quality Review (EPQR) in 2023 at 21 accounting organizations. In an EPQR, an independent accountant performs an objective assessment of the work carried out by the external auditor. The EPQR must be carried out before the audit report is issued. In this way, the EPQR is an important quality guarantee for the quality of statutory audits. Guaranteeing statutory audits of high quality is important for investors, analysts, and other users of the annual accounts. They must be able to trust that the information in the annual accounts presents a true and fair view of reality. 1.1 Stimulating Quality Improvements In our supervision of accounting organizations, we investigate the quality management system of accounting organizations, the quality-oriented culture, and the quality of statutory audits carried out. We do this for both accounting organizations with a license to carry out statutory audits of Entities of Public Interest (AO's-OOB) and accounting organizations with a regular license (AO's-RV). Accounting Organizations for Public Interest Entities In our supervision of AO's-OOB, we encourage them to maintain control over the quality of the statutory audits carried out. In the last investigation into the quality of statutory audits in 2021, we were largely positive in our report about the insight that internal quality research provides into the realized quality of OOB accounting organizations.1 Accounting Organizations with a Regular License We have been supervising AO's-RV since January 1, 2022. In the current phase of our supervision of these accounting organizations, we want to gain insight into their quality risks and make them aware of their current quality level. We also want to encourage them to implement necessary quality improvements for the execution of statutory audits, so that they can gain control over the quality of the statutory audits carried out. 1.2 EPQR is an Important Quality Guarantee The EPQR is anchored in legislation and regulation2 and is mandatory for statutory audits of Entities of Public Interest (OOBs). The objective of the EPQR is to establish that the external auditor could reasonably reach his opinion. In practice, this means that the EPQR is carried out by an independent accountant from within or outside the accounting organization who is sufficiently competent and has sufficient relevant work experience. Because the EPQR is carried out before the issuance of the audit report, the EPQR is an important preventive quality guarantee that accounting organizations use for the quality monitoring of statutory audits. If the EPQR is not carried out properly, there is a risk that an incorrect opinion will be issued or that the audit report is insufficiently substantiated. This can result in unjustified confidence among users of the annual accounts. In addition, an evaluation of the entire set of EPQRs carried out by an accounting organization provides the opportunity to make adjustments and thus improve its quality management system.

Going Deeper 3 SUPERVISION REPORT In addition to the mandatory EPQR for the statutory audits of OOB organizations, the guarantee is often also used for non-OOB statutory audits. Whether this happens depends on the assessment criteria that accounting organizations must establish themselves.3 From the report 'Getting Started!', in which we investigated client and engagement acceptance and continuance at AO's-RV, it appears that the EPQR is frequently used as a quality guarantee to eliminate risks.4 In Table 1, the most recent figures are shown of the use of the EPQR as a quality guarantee. Table 1: Use of EPQR as a quality guarantee in relation to all carried out statutory audits License Holder Type Number of statutory audits Number of audits with EPQR Share of EPQR AO's-OOB5 7,585 995 13% AO's-RV6 12,000 1,982 17% 3 Article 18 of the Decision on Supervision of Accounting Organizations. 4 https://www.afm.nl/nl-nl/sector/actueel/2022/december/accountant-onderzoek-ceac. 5 The information is derived from the AFM Monitor based on information provided by the 6 OOB accounting organizations for the financial year 2021. 6 The information is derived from the WECO questionnaires for the year 2023. This information does not contain all accounting organizations with a regular license, so it has been extrapolated over the entire population taking into account the known ratio of the EPQR guarantee. 7 For four OOB accounting organizations, four EPQRs were investigated for each, and for two OOB accounting organizations, three EPQRs were investigated for each. At all 15 regular accounting organizations, two EPQRs were investigated. 8 Article 18 of the Decision on Supervision of Accounting Organizations and Article 8 of the EU Regulation on specific requirements for the statutory audit of financial statements of entities of public interest. 1.3 Use and Execution of the EPQR Investigated We carried out this investigation at all 6 AO's-OOB and at 15 AO's-RV. In total, 52 EPQRs were investigated, of which 22 at AO's-OOB and 30 at AO's-RV.7 EPQRs were selected from statutory audits for financial years 2021 and 2022, for which the audit report was issued between the second quarter of 2022 and the third quarter of 2023. The investigation into the EPQRs was carried out on three important elements for the EPQR, namely: • The depth of the EPQR reviewer's assessment: Is the substantive assessment of the EPQR reviewer adequate and are the main considerations of the carried out assessment documented? • The expertise of the EPQR reviewer: Is the EPQR reviewer sufficiently competent and does the EPQR reviewer have sufficient relevant work experience? • The involvement of the EPQR reviewer: Was the EPQR assigned to the engagement in time and was the assessment carried out in time? We carried out both a testing and an exploratory investigation. Testing Investigation It was tested whether the quality management system for the EPQR of the accounting organization complies with legislation and regulation.8 The quality management system of the accounting organization describes the prerequisites that the EPQR must meet and how the EPQR must be carried out.

Going Deeper 4 SUPERVISION REPORT We also tested whether the actual execution of the EPQR in the selected statutory audits complies with legislation and regulation.9 We always investigated one focus area in the statutory audit that was also assessed by the EPQR reviewer.10 This allowed us to assess whether the EPQR functioned as a guarantee. We present the results of our testing investigation in this report with the term 'findings'. Exploratory Investigation In addition to the testing investigation, we assessed how the EPQR is used as a quality guarantee by the accounting organizations. For example, to which official the EPQR is assigned and how the accounting organization assesses whether the assigned EPQR reviewer has sufficient time available to carry out the EPQR. We also assessed how the EPQR was carried out in the selected statutory audits. For example, by gaining insight into the moment of assignment of the EPQR reviewer and the moment of execution of the EPQR relative to the execution of the audit. Furthermore, we looked at whether the EPQR reviewer asked questions to the external auditor during his assessment and how these questions were followed up, and whether the EPQR reviewer followed specific training for the execution of the EPQR. We present the results of our exploratory investigation in this report with the term 'enhancements'. Good Examples Based on the investigation carried out, we also see good practice examples at accounting organizations. In this report, these practice examples are marked with a 'green check'. 9 Article 18 of the Decision on Supervision of Accounting Organizations and Article 8 of the EU Regulation on specific requirements for the statutory audit of financial statements of entities of public interest. 10 Tested against NV COS 500.6. 11 https://www.afm.nl/~/profmedia/files/doelgroepen/accountantsorganisaties/2024/slidedeck-okb-onderzoek.pdf 1.4 Deepening of Research Results with the Sector The accounting organizations involved in the investigation all received an individual report with the research results. We held discussions with each accounting organization about this. In these discussions, we reflected on how they are going about improving their EPQR. In addition, we shared the research results during meetings with the investigated accounting organizations. In these meetings, we entered into a dialogue about the investigation and the results. These deepening meetings were experienced as positive and gave accounting organizations the opportunity to exchange experiences on how the EPQR can be improved. Finally, we organized a webinar for accounting organizations not involved in the investigation. In this, the main results were shared, and we explained how the EPQR must be improved based on the good practice examples from the investigation. We look back on constructive sessions with the sector. A summary of the presentations to the accounting organizations is on our website.11

Going Deeper 5 SUPERVISION REPORT 1.5 What does the AFM expect? We expect accounting organizations to go deeper when it comes to the EPQR. By this, we mean that especially the depth of the EPQR must be improved to let the quality guarantee function better. With the results of this investigation, accounting organizations are enabled to strengthen the EPQR and thus sustainably (further) increase the quality of statutory audits. We provide handles for this with findings, enhancements, and good practice examples, and we expect the sector to get to work with this. We will actively follow the quality improvement for the EPQR in the coming years and adjust our future supervision activities accordingly if necessary.

Going Deeper 6 SUPERVISION REPORT 2. Results from our investigation 12 Article 18 of the Decision on Supervision of Accounting Organizations and Article 8 of the EU Regulation on specific requirements for the statutory audit of financial statements of entities of public interest. In this chapter, we present the main findings, possible enhancements, and good practice examples. We conclude that the Engagement Partner Quality Review must be improved to guarantee the quality of statutory audits. The EPQR functions insufficiently as a guarantee at AO's-OOB and AO's-RV and must be carried out in a more in-depth manner. For AO's-RV, the quality management system for the EPQR must additionally be improved. We also ask these accounting organizations to pay attention to the expertise and involvement of the EPQR reviewer. The majority of AO's-OOB have the quality management system for the EPQR in order. This also applies to the elements expertise and involvement. We have not noted any findings on this. 2.1 Depth of EPQR Reviewer's Assessment Must Be Better The depth of the EPQR reviewer's assessment is essential to function as an effective quality guarantee. By depth of the EPQR reviewer's assessment, we mean an adequate substantive assessment of at least the legally mandatory subjects.12 Thus, the EPQR reviewer assesses independence, whether the external auditor has identified all significant risks, the audit differences, and whether sufficient audit information has been obtained to substantiate the external auditor's final opinion. The EPQR reviewer can indicate during the process that audit information is missing and additional audit work is necessary. In addition, the EPQR reviewer has the option to include additional parts of the audit file in his assessment based on his own estimate. Findings from Testing Investigation The investigation shows that the EPQR must be carried out in a more in-depth manner to guarantee the quality of statutory audits. The findings on the depth of the EPQR reviewer's assessment are shown in Figure 1. Figure 1 Results of testing investigation on the element depth of the EPQR reviewer's assessment. Findings on Depth AO's-RV 26 of 30 AO's-OOB 9 of 22 At AO's-RV, we noted findings on the depth of the EPQR reviewer's assessment in 26 of the 30 investigated EPQRs. The main finding is that in 25 of these 26 cases, the EPQR reviewer did not guarantee that the obtained audit information was sufficient to substantiate the external auditor's opinion. In these cases, we established that insufficient audit information was obtained for a focus area that was also assessed by the EPQR reviewer. The EPQR reviewer should have prevented these findings.

Going Deeper 7 SUPERVISION REPORT On the 26 EPQRs, we also noted other findings, whereby multiple findings can occur on one EPQR. For example, the EPQR reviewer did not assess the mandatory subjects of independence (4 cases), the noted audit differences (4 cases), the topics discussed with the management or supervisory board (5 cases), and the audit report (3 cases). In 5 cases, the EPQR reviewer also did not discuss the results of his assessment with the external auditor. Furthermore, we saw 3 cases where the EPQR was not completed at the time of issuance of the audit report. It is mandatory that the EPQR is completed before the audit report is issued. At AO's-OOB, we noted findings on the depth of the EPQR reviewer's assessment in 9 of the 22 investigated EPQRs. In 6 of these 9 EPQRs, the EPQR reviewer did not guarantee that the obtained audit information was sufficient to substantiate the external auditor's opinion. In these cases, we established that insufficient audit information was obtained for a focus area that was also assessed by the EPQR reviewer. The EPQR reviewer should have prevented these findings. On the 9 EPQRs, we also noted other findings, whereby multiple findings can occur on one EPQR. In 2 cases, we established that sufficient audit information was obtained for the focus area that was also assessed by the EPQR reviewer, but the EPQR reviewer evaluated with insufficient depth whether the external auditor had obtained sufficient audit information. The EPQR reviewer also assessed the identified risks in the audit insufficiently (3 cases), documented the main considerations in his assessment insufficiently (3 cases), and did not discuss the results of his assessment with the external auditor (3 cases). These are mandatory subjects for the EPQR. Possible Enhancements from Exploratory Investigation During the execution of our investigation, we noted a number of opportunities for accounting organizations to strengthen the depth of the EPQR reviewer's assessment: • Ask EPQR reviewers to determine and document the EPQR strategy. Why is a part of the audit important or not important to include in the assessment? • Have EPQR reviewers determine whether the involvement of the external auditor during the audit is sufficient and appropriate. • Have the questions asked by the EPQR reviewer documented. Just like the follow-up by the external auditor and the closure of the EPQR reviewer. This provides insight into the carried out assessment. • Carry out regular internal quality research to gain insight into the quality of the carried out EPQRs. Good Practice Examples We share below a number of good practice examples of an in-depth assessment by the EPQR reviewer that we saw during the investigation. Good practice – Documentation of EPQR An accounting organization uses a work program, which includes among other things: • The EPQR strategy. The EPQR reviewer must include the characteristics of the audit client important for the EPQR in this. The EPQR reviewer must also document why he includes or excludes certain significant occurrences and significant risks in his assessment. • The questions the EPQR reviewer asked the audit team and the main discussions the EPQR reviewer had and with whom. This makes it clear why an EPQR reviewer chose a certain approach, which documents were assessed by the EPQR reviewer, what the main discussions were, which questions were asked during the EPQR, and which answers were given to them.

Going Deeper 8 SUPERVISION REPORT Good practice – Documenting Considerations The EPQR reviewer carried out an in-depth assessment on the selected focus area at multiple moments during the audit. A detailed documentation was made of this, showing which questions were asked and how they were followed up. The EPQR reviewer asked critical and detailed questions about the risk assessment procedures, the audit approach, the carried out work on internal control measures, data-oriented work, and the disclosures in the draft annual accounts. The external auditor followed up on these questions during the audit and made a short documentation of this in the EPQR work program. The EPQR reviewer then assessed at multiple moments whether the comments were adequately followed up. 2.2 Appropriate Expertise and Timely Involvement of the EPQR Reviewer is Important Appropriate expertise and timely involvement of the EPQR reviewer is important for an adequate assessment. For AO's-RV, we ask for attention for this. An expert EPQR reviewer is competent and has sufficient relevant work experience to carry out an objective, professionally critical assessment. An involved EPQR reviewer carries out his assessment in time. That is, shortly after the completion of the work by the external auditor and preferably at multiple moments during the audit. This makes it possible to make adjustments in time if necessary. An involved EPQR reviewer also spends as much time as necessary for an adequate substantive assessment. Findings from Testing Investigation The investigation shows that attention is needed for the expertise and involvement of the EPQR reviewer. The findings on the expertise of the EPQR reviewer are shown in Figure 2. Figure 2: Results of testing investigation on the element expertise of the EPQR reviewer. Findings on Appropriate Expertise AO's-RV 5 of 30 AO's-OOB 0 of 22 At AO's-RV, we noted no findings regarding the expertise of the EPQR reviewer in 25 of the 30 investigated EPQRs. In the 5 remaining cases, we saw that an accounting organization, when assigning the EPQR reviewer to the statutory audit, did not establish that the EPQR reviewer was sufficiently competent and had sufficient relevant work experience to carry out the assessment. At AO's-OOB, no findings were noted regarding the expertise of the EPQR reviewer in the investigated EPQRs. We did not investigate the element of involvement of the EPQR reviewer in a testing manner. Possible Enhancements from Exploratory Investigation During the execution of our investigation, we noted a number of opportunities for accounting organizations to strengthen the expertise and involvement of the EPQR reviewer: • Assign the EPQR reviewer to the engagement in time, at least before the planning phase of the audit. • Instruct the EPQR reviewer to carry out the assessment per phase of the audit, shortly after the external auditor has completed it. This enables the EPQR reviewer to make adjustments in time if necessary. • Ensure that the assigned EPQR reviewer has as much time as necessary available to carry out the assessment with sufficient depth.

Going Deeper 9 SUPERVISION REPORT • Pay attention to the unwanted hierarchical relationship between the EPQR reviewer and the external auditor and whether the EPQR reviewer is dependent on the external auditor for his functioning. • Provide periodic training for EPQR reviewers that specifically addresses the execution of an EPQR and any specific areas of attention. Good Practice Example We share below a good practice example of the expertise and involvement of the EPQR reviewer that we saw during the investigation. Good practice – EPQR Team The EPQR was carried out by an EPQR team; a responsible EPQR reviewer and an EPQR team member. The combination of extensive experience with a fresh perspective and the possibility to brainstorm among themselves as EPQR reviewers contributed to the execution of the EPQR. The responsible EPQR reviewer has extensive relevant work experience as an external auditor and extensive experience as an EPQR reviewer. The EPQR team member has relevant work experience in the sector of the audit client and was assigned to that client as an EPQR reviewer for the first time in that audit year. 2.3 Quality Management System for EPQR Not in Order at AO's-RV The quality management system of an accounting organization includes methods, procedures, and measures. These are important prerequisites for the execution of quality guarantees, including the EPQR. Findings from Testing Investigation The investigation shows that the quality management system at AO's-RV must be improved. The findings on the quality management system for the EPQR are shown in Figure 3. Figure 3: Results of testing investigation on the quality management system for the EPQR. Findings on the Quality Management System AO's-RV 13 of 15 AO's-OOB 1 of 6 At 13 of the 15 investigated AO's-RV, we noted findings regarding