The PCAOB’s June 25, 2025, enforcement action against Deloitte Netherlands, PwC Netherlands, and EY Netherlands is a blunt wake-up call. The board found that hundreds of professionals shared answers on mandatory exams over five years, and the three firms agreed to pay a total of $8.5 million in civil penalties.

This follows a record $25 million PCAOB penalty against KPMG Netherlands in 2024 and sits alongside other large sanctions, such as EY’s $100 million SEC penalty in 2022 for ethics exam cheating. These events form a pattern that audit leaders must address now

What actually happened, in plain terms

From 2018 through 2022, the PCAOB found staff at multiple firms shared answers to mandatory training exams and failed to stop the practice. The misconduct was widespread rather than isolated. Regulators noted weak oversight and poor follow-through when issues surfaced. When training meant to assure independence and professional integrity is compromised, the foundation of audit work is shaken.

Why this matters

Audit work depends on trust. When firms cannot show they enforce training and ethics, investors and audit committees lose confidence. That loss shows up as tougher inspections, higher oversight costs, and strained client relationships. The reputational harm can affect new business and last for years.

Where the system broke

Culture and leadership set the tone. If senior staff tolerate shortcuts, those habits spread quickly. Controls and monitoring failed to detect or stop answer sharing. Accountability lagged when violations were found, which sent the wrong message to staff. These problems are fixable but require clear priorities and hard choices.

A missing piece was how training systems were designed. In many firms, exams could be accessed repeatedly without tighter controls, and proctoring was inconsistent across offices. When systems assume honesty without checks, bad patterns can become routine before anyone notices.

Why better evidence systems matter

Many firms now use smart tools to keep better records and spot unusual training patterns. These systems capture timestamps, who accessed material, and device data so that when a regulator asks for proof, it can be produced quickly. The point is simple: clear records change the conversation with inspectors from guesswork to facts.

Beyond logs, these systems can manage the workflow for investigations. They keep notes, assign owners, and show the steps taken to correct behavior. That paper trail is what turns a regulatory review into a contained episode rather than a prolonged crisis.

A clear seven-step program you can plan now

1. Set a board-level mandate with a clear budget and deadlines.
   
   
2. Add controls to training systems, such as single-use exam tokens and strict access rules.
   
   
3. Capture continuous evidence so every session has logs, proctor notes, and ownership.
   
   
4. Require supervisors to watch and act, with clear rules for intervention.
   
   
5. Use data to select work for independent review instead of random choice.
   
   
6. Track every case from allegation to closure with written records.
   
   
7. Bring in an outside reviewer to validate progress and restore confidence.
   
   

Each step is designed to create proof that leaders and auditors can show regulators and clients. Boards respond to facts; these steps create facts.

Real examples that make the case

Firms that started continuous evidence capture handled regulator requests in days rather than weeks. Targeted monitoring of partner training flagged answer sharing in a matter of weeks at one firm, which let leadership act before the issue spread. Those outcomes shortened investigations and helped keep clients calm. When firms can show timestamps and corrective actions, they turn a difficult inspection into a clear series of steps with outcomes.

One client example involved a mid-sized firm that kept proctor notes on every partner exam. When an issue emerged, the firm could show who saw the answers, when they did it, and what sanctions followed. That level of detail stopped speculation and kept the story out of the press.

How to show results to the board

Keep the scorecard short and focused. Track the incidence rate of exam misconduct, average time to retrieve evidence, average time to close investigations, and the number of independent reviews completed. Add simple dollar estimates for potential fines avoided and client retention gains. Present trends over time and use real examples from pilot work to make the case. Boards fund what they can understand and measure.

Practical tips for a short pilot

• Pick a small set of high-risk trainings and partner-level exams.
• Connect learning system logs to an evidence tool and add proctor verification.
• Run for 60 to 90 days, then report concrete numbers to the audit committee.

Start small, show real results, then expand with the same clear measures.

How regulators will respond and what they will ask

Expect more focused inspections and more questions about how evidence is stored and retrieved. PCAOB teams will want to see proctoring logs, disciplinary records, and quick access to documents. Firms that hand over organized evidence with timestamps will face shorter and less stressful reviews. Cooperation matters, but so does having the facts ready to show.

Regulators will also expect clear roles and timelines. During inspections, they will test whether a firm can, within days, produce a coherent record that links an allegation to actions taken and outcomes. Firms that cannot will face longer probes, more follow-up questions, and likely stricter oversight.

Having a short narrative, backed by documents, helps. Start with the fact, show the timeline, explain the action taken, and close with the verification. That approach reduces ambiguity for inspectors and shows you treat integrity as a business issue, not an afterthought.

The PCAOB’s $8.5 million penalties are a clear warning that loose controls and weak oversight carry real costs. Act with clarity and evidence now to protect your firm and clients. If you are ready to tighten controls and improve evidence collection, reach out to iRM through their contact us page and start a conversation with a team focused on helping firms show regulators the facts.