I don't know if I have just enough knowledge to be dangerous, but it seems to me that auditors don't really do what people think they do. Auditors seem mainly to just double check the numbers they're handed. This serves a purpose, it provides some level of guarantee that companies that are acting in good faith are generally reporting correct numbers. Auditors don't do what people seem to think they should do - investigate and uncover fraud. If a company wants to commit fraud, the auditors simply aren't resourced in a way that would allow them to uncover it because there's not really that much incentive to uncover the fraud, the fraudster is extremely motivated, and if you wanted that level of hostile investigative work it would be much more expensive for every company.

Also, from a dynamics perspective, this is a lot like the insurance industry. In the insurance industry you can underestimate risk during the good times, take profits, and then go bankrupt in the bad times. In auditing you can spend a lot of money being extremely thorough - you'll lose all your customers because you're expensive and painful. So instead you lower your standards, you're cheap, you're easy to work with, and it's easy for a fraudster to slip through, in the 1 in a 1000 chance that happens the regulator comes down on you like a tonne of bricks. Well ok, but was EY less competent than McKinsey or did they just get unlucky that they're the poor bastards who stepped on the landmine?

Well, maybe in this case we should learn from the insurance industry and institute some sort of fund that all auditors pay into that pays out in the case that fraud is discovered.