AFM: audit firms must strengthen information security

In April 2026 the AFM called on audit firms to further strengthen their information security and IT risk management. AFM investigations have revealed that a number of organisations are paying insufficient attention to IT risks, which may jeopardise the reliability of audit files and the continuity of operations.

Specific areas of concern

The AFM highlights the need for up-to-date risk registers reflecting the current IT environment, well-tested business continuity plans, and careful supplier management when outsourcing IT services. Audit firms should periodically test against these requirements and document the findings in their quality control system.

Relationship with NVKM and SKM

The obligation to maintain an adequate IT risk management process also follows from the new quality management standards (NVKM/SKM). When implementing their quality control system, audit firms must explicitly address IT risks as part of their operational risks.