The auditor asks who approved this rule. What do you show?

On 9 October 2026, Abu Dhabi’s ADGM Registration Authority fined the audit firm PKF Accountants and Business Advisers and its audit principal a combined $100,000: $65,000 for the firm and $35,000 for the principal. An on-site inspection had found “significant deficiencies” in one audit. The inspectors said the firm had failed to obtain sufficient and appropriate audit evidence, that its audit documentation was inadequate, and that there was insufficient evidence of the principal’s involvement in the audit¹.

The fine fell on the auditor. The failure it names is one every audited company knows: the work may have been done, but the file does not show it.

What exactly was the regulator unhappy about?

Three things, as the regulator described them¹:

• The firm “rebutted the risk of fraud in management override of controls”, which is a mandatory fraud risk that cannot be rebutted under International Standards on Auditing.
• It did not obtain enough evidence to support what it concluded.
• There was insufficient evidence demonstrating the registered audit principal’s involvement in the audit.

None of these says the numbers were wrong. They say the reasoning was not recorded where an inspector could find it.

Is your company’s audit file any different?

Your auditors will ask the same question about your controls. Take a rule that decides who gets a refund, which loans are approved, or when a payment is held. Someone will ask who decided it, on what basis, and whether it still does what was approved.

The code answers the first half of that: what the rule does today. It cannot say who chose it or why. Commit history shows who typed the change. It does not show who stood behind it. So the answer gets rebuilt the week before the audit, from memory, tickets and whoever is still around. That is the same gap the regulator found in PKF’s file: conclusions without the evidence trail behind them.

Where does the trail usually break?

• At the decision. The reason was said in a meeting and never written down.
• At the approval. The person who signed off moved on, and nobody knows whether anyone else agreed.
• At the change. The code was edited after approval, and the approval quietly stopped meaning anything.

What does a company that can answer have?

For each rule, a plain-language statement of what it does, a named owner, the reason, the date it was approved, and every change since. Gaps are listed rather than smoothed over: a rule with no owner or no approved reason shows up as exactly that.

AppThentic builds this trail. Each answer in Organization Memory carries its source and its status, and nothing is marked approved by inference. Rules without an owner or an approved reason are listed, not hidden. A rule whose code changed after approval is flagged until its owner confirms it again. Every question, answer and approval is logged with who and when. See Audit and compliance.

What should you do before the next audit?

Pick the five rules that move the most money, such as credit, refund, pricing and eligibility. For each, try to produce the owner’s name, the reason and the approval date in ten minutes. Where you cannot, you have found what the auditor would have found.

Why does this matter beyond audit firms?

Because the standard the regulator applied is the one every reviewer applies. A conclusion is only as good as the record that lets someone else check it. If a reviewer cannot see who was involved, what evidence was used and what was decided, it makes little difference that the work was sound. The same goes for the rule that holds a payment or approves a loan.

Sources