Aren't they supposed to change every couple of years, under SOX, exactly to prevent auditors and clients becoming to intimate? Mind you, Wirecard was a German company, so SOX didn't apply.
Also, government oversight was kind of limited, it only applied to the German banking activities.
While SOX can be a pain, there are very valid reasons for it. Hopefully Germany learns its lesson and implements something similar after Wirecard.