While I can’t speak as much for credit ratings, the approach for audited financial statements is simply for the stakeholders requesting the financial statements choose the firm who is going to be responsible for signing off on them, not the management of the firm being audited. If you’re a firm that has a contract with a bank to work on the audits or reviews of financial statements for companies that are trying to get and maintain loans with a bank, then you have the right incentive to find out what’s really going on, because if you screw up, you may lose that contract. If the audit procedures are well-documented, any additional entity that wants audited financial statements should be able to follow the first audit and not have all too much work to do, plus that would provide automatic peer reviews of audits.
Of course for public companies, that just turns everything over to the stock exchanges, who I presume are the primary source of the requirement for companies that they list to get audited. I also know that there are some tax issues that require an “applicable financial statement” and so to take it to the logical extreme, anyone who wanted to qualify for the favorable tax treatments of being an entity with an applicable financial statement would have to have the government contract out an audit.
If that was how firms were chosen, it would create the right dynamic, but it’s not particularly easy to do it that way now that we’ve been doing it another way for so long. It would likely increase the costs of the audit without all that much to show for it, as most of the time there’s nothing to uncover. So really it becomes one of those things where you do the best you can economically and hope that the really bad case doesn’t happen since preparing for it would simply cost more overall than it would save in that worst case.