When Gatekeepers Fail: What Auditors, Supervisors, and Raters Share

Why we have to trust gatekeepers

No investor can audit a corporation’s books themselves, no saver can assess their bank’s risks, no bond buyer can check the debtor’s solvency in every country where it operates. That is why gatekeepers exist. Statutory auditors confirm that financial statements comply with the rules. Financial supervisors oversee banks, insurers, and parts of the capital market. Rating agencies assess how likely a debtor is to service its debts. Their shared purpose is to make trust possible where checking for yourself would be too expensive or impossible.

In the major crises of the past twenty years, precisely these bodies failed. Before 2008, rating agencies gave top grades to mortgage securities that soon turned into junk. Auditors signed off on financial statements of companies in which billions were missing, as in the cases compared in Patterns of major accounting scandals. Supervisory authorities took action against critics instead of those being criticized, as Chronicle of an accounting scandal shows for 2019.

The guiding question of this essay is: What do auditors, supervisors, and rating agencies have in common when they fail, and what follows for an owner who relies on others’ confirmations in their own business? To answer it, we clarify the concept of the gatekeeper, describe three shared weaknesses, contrast two readings, and finally draw conclusions for everyday business.

Terms: the gatekeeper and its borrowed reputation

In corporate governance research, such controllers are called gatekeepers. The term refers to independent professionals or bodies whose judgment opens or closes access to markets: no stock exchange listing without an audit opinion, hardly any bond without a rating, no bank without the supervisor’s license. The gatekeeper lends the checked party something it does not have alone: credibility based on the gatekeeper’s reputation.

• Statutory auditor: Checks whether the financial statements comply with the rules and issues an audit opinion. An audit opinion is a judgment on audit procedures and not a guarantee.
• Financial supervisor: In Germany, mainly BaFin. Since 2022, it has examined the financial statements of capital market-oriented companies on its own and with search powers.
• Rating agency: Assesses the creditworthiness of debtors and bonds with grades. The market is dominated by a few large agencies, usually paid by the rated issuer.

For auditors, what How independent are auditors? describes applies: they serve two masters. They are engaged and paid by management, but their judgment is meant for owners, banks, and the public. This situation is not peculiar to auditors but a feature of almost all gatekeepers.

A gatekeeper does not sell its work but its reputation. And it sells it to the party it is supposed to check.

The mental model: three shared weaknesses of gatekeepers

Comparing the well-known cases, three weaknesses recur. None of them alone explains a failure, but together they create the conditions under which failure becomes likely. I call them the payer, the market, and the mandate weakness.

The payer weakness is the best known. Whoever is paid by the checked party has a reason not to lose it. The market weakness reinforces it, because in a concentrated market a reputational loss costs less: customers can hardly switch. The mandate weakness receives the least attention. When a judgment is legally required, companies buy it even if it contains little information. Demand then depends on the law, not on quality.

An everyday analogy: a vehicle inspection sticker is not bought because the driver wants to know whether the brakes are good, but because they may not drive without it. If the garage issuing it were also the only one in the area and paid by the driver, it would have little reason to be strict. That inspections nevertheless mostly work is due to oversight of the testing bodies and to liability.

What the cases show

For rating agencies, the evidence is most clearly documented. Before the financial crisis, numerous mortgage securities received top grades that were later downgraded en masse. The US government and several states accused the agencies of having distorted their ratings through the conflict of interest with the paying banks. Standard & Poor’s agreed in 2015 to pay around 1.375 billion dollars, Moody’s in 2017 around 864 million dollars. Moody’s stated that the settlement contained no finding of a violation of law.

Frank Partnoy (2017) examined what changed after the US reforms. His finding is sobering: the major agencies remained highly profitable but provided little additional information. Regulated institutions continued to rely mechanically on ratings because rules require them. The new oversight office found numerous deficiencies but did not name the agencies concerned in its reports, so they suffered no reputational cost. Partnoy speaks of regulatory licenses: the value of a rating lies less in what it says than in the fact that it opens doors the law would otherwise keep closed.

The three weaknesses also show up in Germany. The audit market for large companies is highly concentrated, as The Big Four describes. According to a study by Heese (2022), the former private financial reporting enforcement panel suffered from the pattern described by capture theory: supervision without distance from those supervised loses its edge. How supervision has been reorganized since 2022 is described in Financial supervision after 2020.

Two readings: does reputation discipline or does the mandate protect?

The first reading trusts reputation. A gatekeeper lives on its credibility. If it issues false judgments, it loses customers because its opinion or grade is no longer worth anything. According to this reputation thesis, gatekeepers mainly need transparency about their errors; then the market disciplines them itself. The end of the audit firm Arthur Andersen after the Enron case is often cited as evidence.

The second reading considers reputation too weak. When demand comes from an obligation and only a few suppliers exist, a reputational loss costs little. Bunjevac (2009) argues for rating agencies that their reputation alone does not protect the integrity of the market as long as the issuer pays. Partnoy’s finding that oversight reports do not name agencies shows how reputation can even be deliberately spared.

I consider the second reading the more accurate one, without rejecting the first. Reputation works, but only where customers can switch and errors become known. Both conditions are rarely met for the large gatekeepers. It does not follow that control is useless, but that control itself must be controlled: through supervision at arm’s length, through rotation, through liability, and through people who are allowed to object. The role of the short sellers who criticized Wirecard early on is described in Short sellers as investigators?. Their example shows that sometimes those without a mandate look most closely.

What this means for a small business

A small business rarely deals with rating agencies. But it relies daily on others’ confirmations: the tax advisor who prepares the financial statements, the credit agency that rates a customer, a supplier’s certificate, a testing service’s report. The three weaknesses apply there too, on a small scale. The lesson from Chronicle of an accounting scandal fits exactly: every business has figures it only believes because someone else confirms them.

1. List confirmations

   Note the places where you rely on a third party’s judgment: financial statements, customer creditworthiness, supplier certificates, test reports, bank references.

2. Check the payer

   For each confirmation, ask who pays for it. A certificate the supplier ordered itself is useful but not independent evidence.

3. Create alternatives

   For important judgments, occasionally obtain a second source, such as a second credit report or your own spot check.

4. Read the content, not the label

   Read what a confirmation actually checks. An audit opinion says something about rules, not about the future of the business.

5. Allow objection

   Make sure employees can voice doubts about a confirmation without fearing disadvantages.

What holds in general and where it stops

The failure of gatekeepers is not an argument against control but one for better control. The reforms after the major cases point in the right direction: auditor rotation, as described in Auditor rotation as protection, bans on advisory work by the auditor, and supervision with its own powers. They address the payer and market weaknesses. The mandate weakness remains the hardest to fix, because laws can hardly do without reliable confirmations.

The limits of this essay are clear. The three weaknesses are the author’s own classification, not a tested theory. The cases are selected and concern large companies and capital markets. For the rating agencies’ settlement payments, settlements are not a judicial finding of a legal violation, and in ongoing proceedings the presumption of innocence applies to everyone involved.

Conclusion: what gatekeepers have in common when they fail

To the guiding question: auditors, supervisors, and rating agencies have in common that they lend trust others cannot verify themselves, and that they fail for the same three reasons: they are paid by, or stand too close to, those they check; their market offers hardly any alternatives; and demand for their judgment often arises from an obligation rather than its quality. The reputation thesis explains why control usually works. The license thesis explains why it can fail at decisive moments. For an owner, what follows is not general skepticism but a habit: asking about payer, content, and consequences with every confirmation.

Trust in gatekeepers is necessary. Blind trust in gatekeepers is exactly what they deserve least.