AFM Enforcement: Dutch Appellate Court Upholds Audit Quality Ruling

The Netherlands Authority for the Financial Markets (AFM) has secured a complete victory at appellate level in a disciplinary case against an external auditor. On 27 May 2026, the College van Beroep voor het bedrijfsleven (CBb), the Dutch administrative appeals court, rejected every ground of appeal lodged by the auditor and confirmed the three-month register suspension originally imposed by the Accountantskamer in 2022. The decision reinforces that audit quality failures, including inadequate evidence-gathering and audit-file manipulation, carry serious and durable professional consequences in the Netherlands.

Background: How the Case Arose

The AFM complaint and first-instance ruling

The AFM filed the disciplinary complaint in 2020, targeting an external auditor employed by a firm holding a standard-licence (reguliere vergunning) under Dutch audit oversight rules. The regulator's core allegation was that the auditor had issued two statutory audit opinions on which neither clients nor third parties could reasonably rely. The Accountantskamer, the specialist accountancy disciplinary chamber, upheld the complaint in large part in 2022 and imposed a temporary removal from the professional register lasting three months. The auditor appealed to the CBb.

What the CBb found on appeal

The CBb confirmed the Accountantskamer's findings across all grounds. Three distinct failures drove the outcome. First, the auditor had not performed sufficient work to gather adequate and appropriate audit evidence during two statutory audits. Second, the required professional-sceptical mindset was absent throughout those engagements. Third, and most seriously, the auditor had made substantive changes to one of the audit files after the fact, without following the regulatory requirements governing such amendments. Taken together, the CBb found that the nature and gravity of these breaches justified the three-month suspension and that no reduction was warranted.

Why This Ruling Matters for Audit and Accounting Firms

Audit evidence standards are non-negotiable

Both the Accountantskamer and the CBb grounded their reasoning in the principle that financial-statement users, including investors and counterparties making commercial decisions, must be able to trust the information contained in audited accounts. That trust depends entirely on auditors gathering sufficient, appropriate evidence before signing an opinion. The CBb's unambiguous confirmation that cutting corners on evidence-gathering breaches the fundamental principles of professional competence and due care sends a clear signal to all licensed audit firms in the Netherlands: the bar is set at the level of the standard, not at the level of what happens to go undetected.

Post-signature audit-file changes carry the highest risk

The finding on audit-file amendment is arguably the sharpest warning in this ruling. Altering a file's substance after completion, without adhering to the applicable rules on documentation changes, was treated as a distinct and serious breach in its own right. Firms should review their file-lock and amendment-logging procedures now. Any system, whether paper-based or digital, that does not create a clear, time-stamped audit trail for post-sign-off changes leaves the firm exposed to exactly the kind of disciplinary findings confirmed here.

Professional-scepticism failures are systemic, not individual

Regulators across Europe increasingly treat a documented lack of professional scepticism not as an individual lapse but as a signal of firm-level culture and supervision failures. The AFM has been explicit in previous thematic reviews that scepticism must be embedded in engagement methodology, supervision, and quality-review processes, not left to each auditor's personal judgment. This ruling, coming at the end of a six-year enforcement cycle from complaint to final appeal, illustrates how long and how costly such cultural gaps can become when they surface.

Implications for Firms Using Digital Accounting Infrastructure

Audit trails in crypto and digital asset contexts

For firms that handle digital asset engagements, the file-integrity finding carries a particular edge. Blockchain-native assets produce on-chain records that are by design immutable, yet the off-chain audit working papers that capture an auditor's analysis, conclusions, and evidence remain as vulnerable to post-hoc alteration as any other document. Firms relying on crypto accounting software or digital asset accounting software must ensure that those platforms produce audit trails that are as robust as the underlying on-chain data they process. A locked, version-controlled working-paper environment is not optional; it is the minimum standard this ruling expects.

Regulatory scrutiny in the Netherlands is intensifying

This case does not stand alone. The AFM has been active across multiple enforcement fronts in recent months, including setting out Distance Marketing Financial Services Directive requirements for crypto service providers. The common thread is heightened expectation of professional quality and regulatory compliance at every level of the financial services ecosystem. Firms that audit entities with crypto or digital asset exposure should treat this ruling as a prompt to review whether their engagement documentation, evidence standards, and quality-review procedures would withstand the same scrutiny the CBb applied here.

The pattern is not unique to the Netherlands. AMF sanctions for market manipulation across the border in France illustrate that European financial regulators are increasingly willing to pursue and defend enforcement actions all the way through appellate proceedings, a resolve this AFM victory confirms.

What Firms Should Do Now

Immediate actions

Audit and accounting firms with Dutch-licensed operations, or with clients subject to Dutch statutory audit requirements, should consider the following steps in light of the CBb's ruling:

• Audit evidence review: Confirm that current engagement templates require documentation of evidence sufficiency and appropriateness at each significant assertion level, not just at conclusion stage.
• File-lock procedures: Verify that working-paper platforms enforce a hard file-lock at sign-off and that any subsequent amendment creates an automatically dated, reason-coded record visible to quality reviewers.
• Professional-scepticism checkpoints: Introduce or refresh structured scepticism checkpoints in engagement hot-review and cold-review processes, particularly for high-risk areas such as valuations, estimates, and complex transaction flows.
• Training records: Ensure CPD records reflect training on audit documentation standards and professional-scepticism requirements, given that the CBb cited competence and due care as the breached fundamental principles.

Frequently Asked Questions

What is the CBb and why does its decision matter?

The College van Beroep voor het bedrijfsleven is the Dutch specialist administrative appeals court with jurisdiction over, among other matters, appeals from the Accountantskamer. Its decisions are final within the Dutch disciplinary system, meaning the auditor has exhausted all available domestic appeal routes.

What does a three-month register suspension actually mean for an auditor?

During the suspension period, the auditor cannot sign audit opinions or perform statutory audit work in the Netherlands. Reinstatement requires the suspension to expire; there is no provision in this ruling for early return. The firm employing the auditor must manage ongoing engagements accordingly.

Does this ruling create new law for Dutch auditors?

It does not create new statutory requirements. It confirms the existing standards under Dutch audit regulations and the IESBA Code of Ethics as interpreted by the disciplinary system. Its significance is evidentiary: it shows exactly which behaviours the CBb considers serious enough to sustain a suspension at appeal.

How does this apply to firms auditing crypto or digital asset businesses?

The legal standards applied are the same regardless of the type of entity being audited. However, digital asset engagements tend to involve complex valuations, novel transaction structures, and data sourced from blockchain networks, all of which elevate the risk of insufficient evidence-gathering. The audit-file integrity finding is especially relevant given that working-paper platforms used for crypto bookkeeping software environments vary widely in their version-control and access-log capabilities.

Can the AFM bring further action arising from the same facts?

The disciplinary ruling resolves the professional conduct question. The AFM retains separate supervisory powers over audit firms under the Wet toezicht accountantsorganisaties (Wta) and could in principle take firm-level supervisory measures if systemic quality issues were identified, though the published ruling focuses solely on the individual auditor's conduct.

Source: AFM, College van Beroep voor het bedrijfsleven ruling, May 2026