Summary

  • The public record shows different rotation patterns. APNIC's 2018 accounts named PricewaterhouseCoopers; Deloitte was appointed in 2020 for an initial two-year term but withdrew when it could not meet the timetable; Ernst & Young audited the 2021 accounts and was appointed for up to five years. ARIN's published statements name BDO for 2020-2023 and CliftonLarsonAllen for 2024. LACNIC states that it has changed independent audit firm every three to four years since 2004. These observations show rotation, but not by themselves the quality of selection or challenge.
  • RIPE NCC's archive identifies KPMG in 2005 and 2008 and Ernst & Young in 2024 and 2025. Those points do not support an uninterrupted tenure claim: the intervening annual reports must be checked year by year. A useful tenure register should identify the legal firm, network, engagement partner, quality reviewer, appointment date, tender date and non-audit services, rather than infer continuity from a brand.
  • Firm rotation and partner rotation solve different problems. A new partner within the same firm can add challenge while preserving organisational knowledge, but the firm's commercial relationship and inherited judgments remain. A new firm creates a stronger break, but transition cost, small-market capacity and loss of context can weaken the first audit if handover is poor.
  • An unmodified or unqualified opinion provides reasonable assurance about financial statements under a defined reporting basis. It does not certify strategy, procurement value, Board conduct, cybersecurity, grant impact, the fairness of member fees or the effectiveness of every internal control. Members should not convert a clean opinion into a general governance endorsement.
  • Non-audit services require a portfolio view. RIPE NCC's 2025 report recorded EUR 122,000 of audit fees, EUR 47,000 of audit-related fees and EUR 21,000 of tax fees across relevant EY entities. The categories are disclosed, but members also need approval, safeguards, provider alternatives and a statement of why the work does not create self-review or management-participation threats.
  • A proportionate RIR policy would competitively test the firm at least every five to seven years, cap ordinary firm tenure unless members approve a reasoned extension, rotate the lead partner sooner, restrict non-audit work, commission an independent quality review before the relationship becomes entrenched and publish the audit committee's recommendation and dissent without exposing confidential findings.

A clean opinion can conceal a comfortable relationship

The last pages of an annual report are reassuringly formal. An independent firm says it has obtained sufficient appropriate evidence and concludes that the statements present the organisation's financial position fairly, in all material respects, under the applicable framework. The language is standardized because the assurance is defined. Readers often supply a larger meaning: competent management, prudent spending, sound controls and institutional health.

That larger meaning is not in the opinion. The auditor tests risks of material misstatement in financial statements. It does not automatically determine whether a conference produced value, whether a public-policy programme exceeded the registry's mandate, whether procurement found the best supplier, whether a fellowship created dependency or whether member fees were equitably designed. Even internal-control work is directed toward planning the financial audit unless a separate assurance engagement says otherwise.

Comfort grows in the gap between the formal opinion and the wider trust attached to it. Management knows which requests will arrive and how an established team interprets recurring estimates. The auditor knows the systems, personalities and annual timetable. Problems can be resolved early, which is good. Recurring judgments can also become inherited assumptions. A reserve classification accepted for years feels less contestable than the same classification presented to a new team.

There need be no friendship or misconduct. Familiarity is an ordinary human and commercial condition. The audit partner wants a timely, high-quality engagement and values the client relationship. Finance staff want no surprises before the member meeting. The Board wants a clean opinion and an orderly process. Each can act professionally while challenge gradually narrows to the issues everyone already expects.

Rotation is one response, not a magic cure. A new firm can be timid because it lacks context, dependent on management explanations and anxious to justify winning the tender. An experienced firm can challenge forcefully because it knows where records should exist and can see changes against a long baseline. The governance task is to retain knowledge while creating scheduled moments when inherited judgments, fees, scope and relationships are examined by people who did not help establish them.

Members should therefore ask two questions of every clean opinion. What exactly was assured? What arrangements made the assurance provider willing and able to challenge a long-standing client? The first prevents assurance inflation. The second prevents independence from becoming a word printed by the same comfortable accountant each year.

The public appointment history is useful but incomplete

Audit tenure is rarely displayed as one continuous register. It must be reconstructed from annual reports, auditor signatures and Board minutes. That exercise produces evidence, but it also creates traps. A firm's brand can change after a legal reorganisation. The same network can provide work through different country firms. Comparative statements can cause one report to display two financial years even though the auditor was appointed only for the later one. A partner can change while the firm remains.

APNIC provides the clearest documented transition. Its 2018 accounts named PricewaterhouseCoopers and showed audit remuneration to that firm. Executive Council records later explain that Deloitte was appointed in 2020 for an initial two-year term. Deloitte then advised that resourcing constraints prevented completion within APNIC's timetable. In December 2021, the Council resolved to appoint Ernst & Young from the 2021 financial year for up to five years, subject to the relevant consents and earlier resignation or replacement. Meeting papers say EY performed the 2021 audit; the 2023 and 2024 reports also bear EY's opinion.

That sequence shows more than a brand list. The client changed firms, a newly appointed firm encountered a capacity problem, and another large firm was selected under deadline pressure. The published minutes say APNIC approached PwC and EY and that only EY had capacity to complete the work in time. This is not evidence of poor audit quality. It illustrates why rotation needs a procurement plan well before year-end. A theoretical field of major firms can become one practical bidder when the timetable is compressed.

ARIN's statements give another bounded sequence. BDO USA signed the published reports covering 2020 through 2023. CliftonLarsonAllen signed the 2024 report. The documents establish a firm change; they do not, on their own, explain the tender, partner history, fee comparison or Board judgment that caused it.

LACNIC's transparency guideline is unusually direct about policy. It says that since 2004 an independent audit firm has issued the opinion and that the firm changes every three to four years. KPMG signed the English translation of the 2023 report. The claimed rotation practice is a useful governance commitment, though members still benefit from a firm-by-firm tenure table and appointment record.

RIPE NCC's archive provides widely separated points. KPMG signed the 2005 and 2008 reports. EY Accountants B.V. signed the 2024 and 2025 reports, with EY's Dubai branch auditing the Middle East subsidiary for 2025. These points should not be stretched into a claim about every intervening year. The gaps are themselves an argument for a published register that does not require members to search decades of reports.

Firm tenure and partner tenure are different clocks

Public debate often asks how long "the auditor" has served, as if auditor were one person. At least four clocks matter.

The first is the audit-firm clock: how long the legal firm has held the engagement. The second is the network clock: whether a nominally different firm belongs to the same global network or shares systems and commercial interests. The third is the engagement-partner clock: how long the individual responsible for the opinion has led or substantially influenced the audit. The fourth is the quality-review clock: how long the person reviewing significant judgments has occupied that role.

Partner rotation is less disruptive than firm rotation. A new lead can challenge assumptions, reset communication and change risk emphasis while using the firm's accumulated files, specialists and methods. It also leaves the commercial client relationship, firm leadership, prior consultation record and much of the team intact. If the problem is one partner's familiarity, rotation may be enough. If the problem is firm dependence, self-review or institutionalized assumptions, it is not.

Firm rotation creates a stronger break. The incoming auditor must make its own acceptance decision, establish opening balances, understand systems and revisit accounting choices. It can compare the predecessor's judgments with fresh evidence. It also faces a steep learning curve. Registries have unusual revenue models, member categories, number-resource activities, sanctions exposure, investment reserves, event finances and multi-jurisdiction operations. A weak transition can make the first-year audit more reliant on management than the final year of the outgoing firm.

Quality-review rotation adds a second fresh look. The reviewer evaluates significant judgments and the basis on which the engagement team reached conclusions. If the same reviewer repeatedly accepts the same approach, review can become another channel of continuity rather than challenge. Rotation should preserve competence and include a cooling-off period before the reviewer moves into the lead role.

The IESBA long-association framework is useful as a benchmark because it treats familiarity as a threat that can arise from prolonged association and uses partner rotation and cooling-off for public-interest entity audits. RIRs may not meet the legal definition of a public-interest entity in every jurisdiction, and the exact mandatory rule will differ. Their durable control over regional number registration gives them a strong reason to adopt the principle voluntarily.

A tenure register should start each clock separately. It should name the legal firm, global network, lead partner and quality reviewer where lawful, plus first year, latest year, cumulative years, break periods and expected rotation. Without that detail, a Board can announce a fresh partner while members believe the firm changed, or announce a new firm within the same network while the commercial relationship appears more independent than it is.

Knowledge is an asset until it becomes an inherited answer

The case for continuity is substantial. A regional registry's accounts contain recurring judgments that a newcomer cannot master from a trial balance alone. Deferred membership revenue, fee categories, restricted grants, investment valuations, foreign currencies, pension obligations, subsidiary consolidation, related parties, legal contingencies and capitalized systems each have institutional history. An auditor who understands the systems can spend more time testing change and less time learning vocabulary.

Continuity also improves pattern recognition. A familiar team can notice that an estimate moved differently from prior years, that a control owner changed, that an exception once described as temporary has become permanent, or that a reconciliation is arriving later. It knows which documents management produced last year and can challenge a new claim that they do not exist. Smaller organisations may struggle to educate a new firm without diverting finance staff from ordinary control work.

The problem appears when history becomes precedent. An accounting treatment accepted in year one can be rolled forward because reopening it would delay the audit. A threshold designed for a smaller organisation can survive growth. A management representation can become standard wording even after the risk changes. Audit plans can focus on familiar high-value balances while new strategic or digital risks sit outside the established map.

Long association changes conversation as well as method. The finance director knows which evidence satisfies the partner. The partner knows which Board member dislikes surprises. Both may resolve difficult matters informally before the audit committee sees the disagreement. Early resolution is often efficient. It can deprive those charged with governance of information about how close a judgment was, which adjustments were resisted and which controls remain fragile.

Rotation should therefore be paired with a knowledge-transfer design. The outgoing firm should provide lawful professional handover, subject to consent and confidentiality. Management should maintain an accounting-judgment register explaining the issue, framework, evidence, alternatives, decision, approver and annual reconsideration. The incoming firm should identify which inherited positions it independently revisited. The audit committee should receive a transition-risk assessment and protect the new auditor from a timetable that makes fresh challenge impossible.

The objective is not institutional amnesia. It is to convert personal and firm knowledge into records while forcing periodic re-examination. A good rotation policy keeps facts and loses deference.

The audit basis defines the boundary of assurance

APNIC's 2024 auditor report contains an important qualification of purpose without qualifying the opinion. EY describes the accounts as a special-purpose financial report prepared to fulfil directors' responsibilities under Australia's Corporations Act. It says the report may not be suitable for another purpose. The opinion is unmodified, but the basis tells users not to assume that the statements were designed for every analytical need.

This distinction matters across RIRs. Financial statements can comply with the selected framework while omitting measures members would need to judge programme value, fee incidence or service efficiency. Materiality is set for the statements as a whole, not for every governance concern. A related-party amount immaterial to total expense can still matter to a director-conflict question. A control deficiency below the threshold for a modified opinion can still deserve Board action.

An audit opinion is also retrospective and sampled. It does not guarantee that every transaction was tested or that fraud is impossible. Auditing standards require risk assessment, evidence and professional judgment at a high but not absolute level of assurance. Collusion, forgery, management override and concealed arrangements can be harder to detect. The public report normally explains this, yet annual communications often collapse the nuance into "the auditors found no issues."

Boards should publish an assurance map beside the accounts. It should list the financial-statement audit, any tax or regulatory work, cybersecurity assurance, internal audit, election assurance, grant evaluation and other independent reviews. For each, show provider, scope, period, standard, assurance level, exclusions, materiality where publishable and response owner. Gaps should be explicit.

The map prevents double counting. A statutory auditor may consider information-security controls only insofar as they affect financial reporting. That is not a penetration test. It may read Board minutes for contingencies and related parties. That is not an assessment of Board effectiveness. It may test a sample of travel expenses. That is not a judgment about the geography of institutional influence.

Members should also see management's responsibility. The auditor does not prepare the accounts, design all controls or decide the estimates. Independence would be undermined if it did. A clean report should therefore be presented with the Board's statement on unresolved findings, corrected misstatements, control actions and scope limits. The comfort of an external signature should not displace internal accountability.

Once assurance boundaries are clear, rotation can be designed around actual risk. A registry may retain a strong financial auditor while commissioning a separate independent review of a contested programme. Conversely, changing the statutory firm cannot cure gaps in cybersecurity, procurement or governance assurance that were never part of its engagement.

Non-audit services can turn knowledge into self-review

The incumbent auditor knows the organisation and can often provide tax, systems, transactions and advisory work efficiently. That efficiency creates the classic independence problem: the firm may later audit an answer it helped design.

RIPE NCC's 2025 Financial Report makes the categories visible. It reports EUR 122,000 of audit fees, EUR 47,000 of audit-related fees and EUR 21,000 of tax fees for services by EY entities relevant to the consolidated group. Other non-assurance fees were zero in 2025, compared with EUR 7,000 in 2024. The note says the amounts relate to procedures by the external auditors, including tax and advisory services.

Disclosure is the starting point. Members still need to know what "audit-related" covered, which entity provided the tax work, who approved it and why another provider was not preferable. Audit-related assurance can be closely connected to the statutory engagement and create little threat. Tax compliance can be routine. Tax structuring, system implementation, valuation, internal audit, executive recruitment and strategic advice can create stronger self-review, advocacy or management-participation risks.

The audit committee should pre-approve permitted non-audit services through a narrow policy. Prohibited services should include taking management decisions, designing controls the firm will audit, maintaining accounting records, setting material estimates and advocating the client's position in a way incompatible with independence. Permitted exceptions should document threat, safeguard, fee, provider alternatives and why the incumbent is necessary.

Fee dependence must be viewed from the firm and local office perspective, not only the registry. An RIR may be small to a global network but important to a local partner or specialist team. The public cannot calculate this from the registry's fee note alone. The committee should obtain the firm's independence assessment, including total fees from the institutional family and connected entities, and report the conclusion.

The denominator matters within the client too. If non-audit fees approach or exceed audit fees, the commercial relationship may look advisory with an audit attached. A simple ratio is not a verdict; specialized one-off work can be legitimate. It is a trigger for tendering the extra work or commissioning an independent review.

Rotation can fail if the old audit firm simply becomes the new consultant and the new auditor relies on systems the old firm designed. Cooling-off and service restrictions should follow the network relationship, with a register of former auditors' contracts. Independence is a portfolio condition, not a sentence in one engagement letter.

Appointment authority determines whose questions the auditor hears

An auditor is formally engaged by a legal entity, but the practical client can become management if governance bodies are passive. Management prepares the tender material, answers bidder questions, supplies references, negotiates fees, schedules fieldwork and controls access to records. A Board that votes on a recommendation assembled entirely by the finance team has not necessarily appointed an auditor independent of that team.

The audit committee or an equivalent group should own selection. It should approve the risk brief, bidder list, evaluation method, conflicts, interviews, recommendation and engagement terms. Finance staff should provide technical input and judge feasibility, but should not hold a majority of scoring authority. The chief executive and finance director can respond to the preferred bidder; they should not possess a private veto.

Member authority differs among RIRs. Some accounts are presented to members for adoption or approval; Boards often appoint or recommend auditors under local law and governing documents. Whatever the legal route, members should receive the committee's reasoned recommendation before the decisive meeting. It should identify term, proposed lead partner, fee, non-audit restrictions, tender participation, transition plan and reasons for retaining or changing the firm.

Incumbent reappointment needs more than a statement that performance was satisfactory. The committee should report audit quality, challenge, staffing continuity, timeliness, findings, fee development, management responsiveness, partner tenure and independence. It should say which alternative firms were considered and whether a tender occurred. Commercially sensitive bid details can remain confidential; evaluation categories and final reasons should not.

The auditor needs a direct route to those charged with governance. Private sessions without management should occur at least annually. The committee should ask about aggressive judgments, delayed evidence, corrected and uncorrected misstatements, control deficiencies, scope constraints, management pressure, fraud risk and matters the auditor expected to communicate but resolved informally. The minutes can summarize topics without disclosing protected detail.

Members also need a contact route for evidence relevant to the audit, protected from retaliation and frivolous disclosure. The auditor should not become a general complaints office. A defined channel can help surface related parties, side agreements or control override that ordinary management paths suppress.

When appointment authority is clear, the auditor knows that losing management's favour is not the same as losing the engagement. That is a more important independence safeguard than ceremonial use of the word "external."

A competitive tender should test challenge, not just price

Audit procurement can produce the wrong competition. A low bidder may plan fewer senior hours, depend on junior staff or assume the incumbent's accounting conclusions. A prestigious firm may offer a polished presentation without the local capacity to meet the reporting date. APNIC's 2021 transition shows that practical availability can overturn an intended appointment.

The tender should begin twelve to eighteen months before a planned change. Early market engagement can identify firms licensed in the jurisdiction, conflicts with registry suppliers or members, language capacity, network dependencies, digital-audit skill and peak-season availability. It gives the outgoing firm and finance team time to plan handover without compressing fieldwork.

Evaluation should weight audit approach, independence, partner time, sector understanding, technology and data methods, specialist access, transition plan, quality history, team continuity, communication with members and price. Sector experience is useful but should not become a requirement only the incumbent can satisfy. Bidders can demonstrate how they would learn an RIR and challenge a hypothetical recurring judgment.

The risk brief should identify unusual features without giving bidders management's preferred answer. It can mention fee revenue, deferred income, reserves, sanctions, related parties, grants, investments, subsidiaries, service continuity and major systems. The committee should ask which areas the bidder considers most susceptible to material misstatement and why. A bidder that merely repeats the brief may offer less fresh thought than one that identifies an omitted risk.

Independence screening should cover the global network where relevant. A large audit network may provide services to Board-linked organisations, investment managers, major vendors or subsidiaries. Most relationships will not bar appointment, but the bidder should describe them and the safeguards. The same exercise should cover recent employment of registry finance staff by the firm and vice versa.

Reference checks should ask about challenge and continuity, not only politeness and punctuality. Did the partner raise difficult matters early? Were specialist findings integrated? Did team members change repeatedly? Were fees increased through predictable extras? Did the firm communicate control weaknesses clearly? A former client may be constrained in what it can say, but the questions signal expectations.

The winning score and reason should be published at category level. If the cheapest bidder did not win, explain the quality trade. If only one capable bidder remained, disclose that market constraint and schedule an independent quality review sooner. Competition is a means to credible assurance, not a ritual for producing three logos.

Rotation intervals should be presumptions, not cliff edges

The European Union's statutory-audit regulation sets a maximum ordinary firm engagement of ten years for public-interest entities, with specified tender and joint-audit routes for longer periods and a four-year break after the maximum term. That law does not automatically classify or govern every RIR. It supplies a useful outer benchmark: even heavily regulated audit markets treat indefinite firm tenure as a risk.

LACNIC's stated three-to-four-year firm change is at the more frequent end. APNIC's 2021 resolution contemplated a five-year EY term. These intervals suggest a practical RIR range, but one fixed number cannot accommodate every legal market and transition.

A sensible voluntary policy would competitively test the engagement at least every five to seven years and presume firm change no later than seven to ten years. Retention after a tender should require an audit-committee paper explaining quality, market capacity, transition cost, partner rotation, independence and safeguards. Members should approve or at least receive the exception before appointment. No extension should be automatic.

The lead partner should rotate sooner, commonly after five years for a high-public-interest institution, with a cooling-off period that prevents immediate return as quality reviewer or informal shadow partner. Exact periods should follow applicable professional rules where stricter. Other senior personnel should rotate enough to create challenge without replacing the entire team in one year.

Cliff-edge rotation can damage quality if everyone changes at once. Staggering partner, reviewer and firm transitions can preserve knowledge. The final incumbent year should document major judgments and control history. The first incoming year should receive extra partner and specialist time. Fees may rise during transition; the budget should recognize this rather than force a low-cost first audit.

Emergency extension needs a rule. Litigation, corporate restructuring, a security crisis or collapse of the tender field may make immediate change imprudent. The committee should define the exceptional condition, obtain an external independence view, rotate senior personnel where possible, commission a targeted quality review and set a non-renewable end date.

The interval is a presumption because tenure risk is continuous, not a switch activated in year ten. Warning signs can require earlier action: declining challenge, repeated late surprises, unexplained fee dependence, extensive non-audit work, management-aligned language, recurring team turnover or a failure to escalate control weaknesses. Conversely, a high-performing firm should not be retained indefinitely merely because no failure is visible. Familiarity often operates before it can be proven.

Independent quality review can test the years between tenders

Firm rotation is expensive and episodic. An independent quality review can create a fresh look during the term, especially where the market is small or a transition would create risk.

The review should not re-perform the entire audit or second-guess every judgment. It can examine the audit plan, risk assessment, materiality, significant estimates, related-party work, group-audit instructions, going concern, corrected and uncorrected differences, control findings, independence, non-audit services and communication with the Board. It should assess whether evidence supports the most consequential judgments and whether professional skepticism is visible in the file.

The reviewer must be independent of both client and audit firm. A partner from the same network is not an external review. A regulator or professional inspection may provide evidence but may not address the registry's specific public-interest concerns. The audit committee can appoint another qualified firm or individual with strict confidentiality and conflict controls.

Timing matters. A review in the third or fourth year can inform the next reappointment or tender. A targeted review can follow a major acquisition, subsidiary, accounting change, fraud allegation or disputed estimate. The committee should not wait for a modified opinion, which is a late and blunt signal.

The public report can state scope, reviewer, period, overall conclusion, recommendations and management or auditor response without publishing protected working papers. Serious findings should have owners and deadlines. The incumbent auditor should be able to correct factual errors and respond, but not select the reviewer or suppress conclusions.

Quality review also tests whether rotation is actually fresh. An incoming firm may hire the outgoing team, use the same specialists or accept the same accounting memorandum. None is automatically improper. The reviewer can examine whether opening balances and inherited judgments received independent attention.

IAASB's quality-management standards emphasize the engagement partner's responsibility for quality and the evaluation of significant judgments by an engagement quality reviewer. Those standards operate within the audit firm's system. A registry's external review adds a client-governance safeguard; it does not replace the firm's obligations or professional inspection.

The possibility of review can improve behaviour without making the relationship adversarial. Management knows that recurring estimates may be seen by a fresh expert. The auditor knows that challenge and documentation, not merely the final opinion, will be examined. Members gain evidence about process quality rather than waiting for a financial failure to reveal that comfort had gone too far.

The audit committee should report disagreement, not only completion

Annual audit-committee reports often say the audit was completed, the auditor remained independent and the statements were recommended for approval. That is useful but thin. A committee demonstrates oversight by showing what it tested and how it handled tension.

The report should describe significant judgment categories, not confidential amounts where disclosure would cause harm. It can say that the committee examined revenue recognition, reserve valuation, legal contingencies, related parties, subsidiary consolidation, pension assumptions or system access. It should distinguish matters raised by the auditor from those management identified.

Corrected misstatements should be reported by aggregate category and significance. Uncorrected items should be summarized with the reason the auditor and committee accepted them. Members do not need a dump of trivial differences. They need to know whether management repeatedly resisted adjustments or whether a disputed judgment was close to materiality.

Control findings need status. Which high or medium issues remained open from prior years? Which deadlines moved? Did management accept the recommendation, design an alternative control or accept the risk? A clean opinion can coexist with control recommendations; publishing their existence does not undermine the audit.

Private auditor sessions should produce a member-facing assurance that the committee asked about access, pressure, fraud, management tone, team competence and non-audit work. If no disagreement occurred, the committee can say so. If a significant disagreement was resolved, the subject and resolution path should be described without prejudicing legal or security interests.

The committee should evaluate the auditor independently of management's satisfaction. Criteria should include skepticism, partner attention, specialist use, continuity, clarity, timeliness, fee predictability, findings and willingness to challenge. Management feedback is one input, not the score.

Reappointment recommendations should disclose tenure clocks and next trigger. "EY has served since financial year 2021; the lead partner has served since X; a competitive tender is planned for Y" is more informative than "the auditor is independent." If a name or date cannot be published under local rules, the duration can.

Dissent should be visible. A committee member who favours tendering or opposes non-audit work should be allowed a concise recorded reason. Unanimity may be genuine, but governance reports should not manufacture it by omitting minority judgment. Members can then see that independence was considered as a real choice rather than a compliance statement.

A practical RIR audit policy can combine continuity with challenge

A strong policy would begin with an assurance and authority map. It would identify which entity appoints the auditor, which committee owns selection, what members approve, which reporting framework applies and what the financial audit does not cover. It would list other assurance providers so no clean opinion is used as a certificate for unrelated activity.

The second element is a public tenure register. For each group entity, show audit firm, network, lead-partner tenure where publishable, quality-reviewer tenure, first audit year, latest audit year, tender dates, planned rotation and cooling-off. Record mergers and legal-firm changes. Do not fill archival gaps with assumptions.

Third, tender at a declared interval. Begin market work early, publish weighted criteria, screen network conflicts, compare quality and capacity as well as fee, and disclose the committee's reason. A failed or single-bid tender should lead to stronger interim review, not a false claim of competition.

Fourth, control non-audit services across the institutional family. Maintain prohibited and pre-approved categories, aggregate fees by network, require alternatives for tax and advisory work, and explain material exceptions. Former audit firms should remain in the register when they become consultants.

Fifth, rotate people as well as firms. Set lead-partner and reviewer limits, cooling-off periods and staggered transitions. Require extra resources in first-year audits and structured handover. Preserve judgment records without requiring the incoming firm to adopt them.

Sixth, commission external quality review before comfort becomes visible as failure. A third- or fourth-year review, and another before an exceptional extension, can examine significant judgments, skepticism, independence and Board communication. Publish the scope, conclusion and response.

Seventh, improve committee reporting. Show material judgment areas, corrected and uncorrected items at a proportionate level, control actions, private-session topics, independence analysis, tenure and reasons for reappointment. Give the auditor a direct route to the committee and members an appropriate evidence channel.

Eighth, protect the timetable from management leverage. Appointment and transition decisions should occur early enough that a firm can challenge without fearing it will miss the member meeting. Late accounts should be explained; speed should never be the sole quality measure.

These measures cost money. A tender consumes staff and committee time. A new firm charges for learning. Quality review duplicates some examination. Smaller RIRs may face a limited market. The cost should be compared with the value of credible accounts for institutions holding large reserves, collecting compulsory-like recurring fees and operating durable regional coordination functions.

The policy should be proportionate, but proportionality cannot mean indefinite incumbent retention. Where firm choice is genuinely narrow, partner rotation, service restrictions, external review, transparent reappointment and member scrutiny become more important, not less.

Independence should be renewed before confidence is lost

The comfortable accountant is not necessarily careless. Comfort can reflect competence, mutual respect and years of difficult work completed on time. An auditor who understands the registry may be better able to challenge it than a stranger. The danger lies in allowing that plausible defence to renew itself forever.

Public evidence shows that RIRs do change firms. APNIC's sequence records both deliberate terms and a capacity-driven switch. ARIN's reports show a recent move from BDO to CliftonLarsonAllen. LACNIC publicly describes a regular three-to-four-year practice. RIPE NCC's archive shows different firms across the long period and EY in the latest consolidated reports. The missing common element is a complete, member-readable account of tenure, partner rotation, tender reasons, non-audit relationships and quality results.

Members should resist two easy conclusions. Frequent change does not prove independence: a rushed tender can produce a weak first audit, and global networks can preserve relationships beneath new legal names. Long tenure does not prove capture: a disciplined committee, rotating partners, restricted services and external review can sustain challenge. Policy should manage the risks rather than use duration as an allegation.

The best moment to renew independence is before either side believes change is a punishment. A pre-declared term lets the outgoing firm document knowledge, the incoming market prepare and management budget for transition. A cooling-off period makes departure ordinary. A published review tells members whether continuity still earns its cost.

Audit quality is difficult to observe because successful challenge is often confidential and financial failure is a late indicator. That makes process evidence important. Who appointed the firm? What alternatives were tested? How long have the people served? Which extra services were sold? What judgments received a fresh look? What did the committee do when auditor and management disagreed?

An unmodified opinion should remain reassuring within its boundary. It says skilled outsiders performed defined work and reached a conclusion under professional standards. It should never become the institution's all-purpose certificate of virtue, nor should an incumbent's familiarity be marketed as irreplaceable knowledge.

The governing principle is renewal without amnesia. Keep the accounting history, control records and sector understanding. Rotate authority, retest inherited answers and expose commercial dependencies. If the relationship is still strong, it will survive a competitive examination. If it cannot, the comfort was already too expensive.

Sources