In my experience with auditors, harsh/rigorous does not necessarily mean better because the auditor’s mindset makes an enormous difference. I’ve had process-focused people spend days of their time and mine digging into things that do not have a material impact on results. Unfortunately, even if people have the best intentions, I think that process-focused-but-loose and results-focused-but-rigorous can be easy to mix up, especially for people not in the weeds.

Because it is an absolute race to the bottom (on price) when it comes to Big 4 audit. There is really no distinction or difference in services provided between the firms. You can practically switch from EY to one of the other three (if they don't mind excluding themselves from consulting work) overnight.

Disclaimer: work for Big 4 but in tech consulting, not audit.

OTOH it was the Big 5 until Arthur Anderson gave up its license due to the Enron fraud.

So there's an incentive to audit correctly.

There's the same kind of incentive not to be the closest moth to the lightbulb, and yet....

The race-to-the-bottom/die-at-the-bottom reward structure only prevents disaster if the racers are invested for the long term. The agents in charge will have a high tolerance for that kind of risk if they hope to retire/sell before the money train jumps the tracks. I don't know if that's a hazard this industry is currently falling into, but it's a likely failure mode if nothing sufficiently enforces agents taking a long view.

Because you can switch to another firm which is more friendly to you.

There are certain practices that a company does, and various auditors have different opinions on it. For example, in PCI there are ways of interpreting certain requirements: and when you choose an auditor, you want one that agrees with your approach, and don't want the one that insists on different approach.

Auditing large corps is a profitable business with only a few players "capable" of doing. If one auditor asks too many questions the competitor is happy to take over.