Auditing big firms is hard and to be honest, there's little general audits can do to detect fraud (nor is it even the main goal, forensic auditing is a different beast) and if management is intent to commit fraud, it will happen. But in this case the fraud didn't involve very complex and very opaque structures à la Enron where normal checks wouldn't have been sufficient. The crazy part here is that EY did not verify directly with the banks if the account statements were real, which is very basic and very easy to audit. They just took what Wirecard gave them to confirm what Wirecard told them for something as important as accounts that were supposed to hold almost all the cash the company had. Absolutely insane.

But the thing is EY , like all the big 4, have totally seperate entities for every country they operate in. Now that could mean EY Germany is an isolated case of incompetence and (criminal?) neglect, which would be very surprising considering that EY seems to be involved in a lot of the recent big financial scandals. But it also means that they can't really be "taken down" and are basically immune from existential threats that could actually hurt them.

Yes, there's a partnership structure meaning people at the top of let's say EY Germany have the incentive to keep their credibility and avoid liabilities since they have a direct stake in the business. But considering how many perverse incentives there are ( one of these are low margins and high competition that can encourage having a cozy relationship with who you are auditing to keep the contract) in the auditing world, this opaque structure where EY itself can't lose much more than what it gained... You start understanding why this happen.

But even then EY still really stand out since the rest of the big firms have similar structures yet manage to be a lot more competent.