Auditors answer to several overseers at once. For firms that audit public companies, the Public Company Accounting Oversight Board (PCAOB) inspects the work and can fine or bar them; the Securities and Exchange Commission sits above the PCAOB and can independently suspend an auditor from practicing before it. State boards of accountancy control the CPA license itself. The American Institute of Certified Public Accountants runs a peer review program for firms that only work with private clients. On top of all that, investors can sue auditors directly under federal securities law. That is who audits the auditors, and the consequences run from mandatory retraining to permanent, career-ending sanctions.
The PCAOB: The Main Federal Watchdog
Congress created the PCAOB through the Sarbanes-Oxley Act of 2002 after the Enron and WorldCom collapses ended the profession’s era of self-regulation. It is a nonprofit corporation, not a government agency, but it operates under SEC supervision and any firm that wants to sign an audit opinion for a public company must register with it.1PCAOB. Sarbanes-Oxley Act of 2002 As of 2026, roughly 1,431 firms hold active registrations.2Public Company Accounting Oversight Board. Registered Firms
The Dodd-Frank Act of 2010 extended the PCAOB’s authority to firms that audit SEC-registered broker-dealers, which matters because broker-dealers hold customer assets.3Public Company Accounting Oversight Board. Information for Auditors of Broker-Dealers
Inspections
Inspections are how the Board catches problems before they become scandals. Inspectors review the working papers on selected audit engagements, interview the people who did the work, and evaluate the firm’s internal quality-control system, including leadership culture, partner management, and independence procedures.4Public Company Accounting Oversight Board. Basics of Inspections
Frequency depends on size. Firms that audit more than 100 public companies get inspected every year. Firms that audit 100 or fewer face inspection at least once every three years. Each inspection produces a firm-specific report. Quality-control criticisms stay confidential at first, but if the firm does not fix them within 12 months, the Board publishes them.5Public Company Accounting Oversight Board. PCAOB Inspection Procedures That public disclosure is often a heavier consequence than any fine, because clients and competitors read the reports.
Penalties
Under Section 105 of Sarbanes-Oxley, the Board can revoke a firm’s registration, bar individual auditors from working with any registered firm, impose temporary suspensions, restrict a firm’s activities, levy civil fines, and require additional training, monitoring, or outside consultants to redesign compliance.6U.S. Securities and Exchange Commission. PCAOB Rulemaking – Rule 5300 Sanctions
Fines in real cases range from tens of thousands of dollars to millions. PwC paid a $2.75 million civil penalty for quality-control failures related to auditor independence.7Public Company Accounting Oversight Board. PCAOB Fines PwC 2.75 Million for Quality Control Violations Relating to Independence In a separate matter involving widespread cheating on internal training exams, the Netherlands affiliates of Deloitte, PwC, and EY collectively paid $8.5 million.8Public Company Accounting Oversight Board. PCAOB Imposes Fines Totaling 8.5 Million on Netherlands Member Firms of Deloitte, PwC, and EY After Widespread Exam Misconduct
The Board also requires transparency about who leads each audit. Rule 3211 requires registered firms to file Form AP disclosing the engagement partner’s name and a unique identification number, so investors can track a partner’s history across firms.9Public Company Accounting Oversight Board. Form AP – Auditor Reporting of Certain Audit Participants
The SEC’s Independent Role
The SEC sits above the PCAOB in the regulatory chain. Under Section 107 of Sarbanes-Oxley, no PCAOB rule takes effect without SEC approval, and the Commission can modify or overrule the Board’s standards if they fail to protect investors.10GovInfo. Sarbanes-Oxley Act of 2002
The SEC also disciplines auditors on its own authority through Rule 102(e) of its Rules of Practice. The Commission can censure, suspend, or permanently bar any accountant from appearing or practicing before it. Grounds include intentional or reckless violations of professional standards, a single instance of highly unreasonable conduct in circumstances where the auditor should have known to be more careful, or a pattern of unreasonable conduct suggesting a basic lack of competence.11U.S. Securities and Exchange Commission. Amendment to Rule 102(e) of the Commissions Rules of Practice A Rule 102(e) suspension effectively ends an auditor’s ability to work on any SEC-regulated engagement even if their state license stays active.
Section 10A of the Securities Exchange Act adds another obligation. When an auditor detects information suggesting illegal activity during an audit, the firm must investigate, assess the financial impact, and inform management and the audit committee. If the company does not take appropriate corrective action, the auditor must escalate to the board of directors, and the board then has one business day to notify the SEC.12Office of the Law Revision Counsel. 15 USC 78j-1 – Audit Requirements Auditors who fail to follow that chain face their own enforcement consequences.
Independence Rules
Sarbanes-Oxley Section 203 makes it illegal for a registered firm to keep the same lead audit partner or reviewing partner on a client’s engagement for more than five consecutive fiscal years.1PCAOB. Sarbanes-Oxley Act of 2002 Familiarity breeds complacency, and a fresh partner is more likely to catch problems a long-tenured one might rationalize away.
SEC rules also bar firms from providing certain non-audit services to their audit clients, including bookkeeping, designing or implementing financial reporting software, valuation and appraisal work material to the financial statements, actuarial services, most internal audit outsourcing, and any role that puts firm personnel in management functions at the client.13U.S. Securities and Exchange Commission. Revision of the Commissions Auditor Independence Requirements An auditor cannot objectively evaluate work product the same firm created. The PwC $2.75 million penalty came from exactly this kind of independence failure.
State Boards of Accountancy
Every other layer of oversight regulates firms and their work product. State boards regulate the individual people. They control who earns a CPA license, who keeps it, and who loses it. Each state sets its own education, examination, and experience requirements, and each state enforces its own ethical standards for practice within its borders. Initial application fees typically run from about $15 to $120 depending on the state.
When someone files a complaint alleging misconduct, the state board investigates. If it finds fraud, gross negligence, or ethical violations, available sanctions include public reprimands, fines, mandatory education, practice restrictions, license suspension, or permanent revocation. Losing a license means the individual can no longer sign audit reports or hold themselves out as a CPA in that jurisdiction. State boards work the street level of accountability, and they hear cases the national regulators never see.
AICPA Peer Review for Private-Company Auditors
Not every audit involves a public company. Firms that work only with private businesses, nonprofits, or government entities fall outside PCAOB jurisdiction. For them, the American Institute of Certified Public Accountants runs a peer review program in which one accounting firm examines another’s work.14American Institute of Certified Public Accountants. Peer Review Home Page
AICPA members in public practice must enroll if the firm issues reports under AICPA professional standards, covering audits, reviews, compilations, and attestation engagements. Reviews happen on a three-year cycle. A peer reviewer examines the firm’s quality-control system and a sample of engagements and issues one of three grades: pass, pass with deficiencies, or fail. A failed firm must take corrective action, which can mean mandatory continuing education, pre-issuance review of future engagements by an outside reviewer, or other remedial steps. The review report, the firm’s response, and the acceptance letter are all public, so clients and regulators can check a firm’s track record.
Investor Lawsuits
Regulatory sanctions are not the only consequence auditors face. Private lawsuits are a separate and often financially devastating source of accountability, and the standards differ by statute.
Under Section 11 of the Securities Act of 1933, investors who buy securities in a registered offering can sue an auditor if the registration statement contained a material misstatement or omission in the audited financial statements. The investor does not need to prove the auditor intended to deceive anyone. The auditor’s defense is to show that, after reasonable investigation, they had reasonable grounds to believe the financials were accurate when the registration statement took effect. The statute measures “reasonable investigation” by the standard of a prudent person managing their own property.15GovInfo. Securities Act of 1933
Fraud claims under Section 10(b) of the Securities Exchange Act and SEC Rule 10b-5 carry a higher bar. Investors must prove scienter, which the Supreme Court in Ernst & Ernst v. Hochfelder defined as an intent to deceive, manipulate, or defraud. Mere negligence is not enough. Federal appeals courts have extended liability to reckless conduct, generally an extreme departure from ordinary professional care so obvious the auditor must have been aware of the risk of misleading investors. Simple accounting mistakes or professional-standards violations, without more, do not meet the threshold.
How to Report an Auditor
If you suspect an auditor is cutting corners, fabricating work, or overlooking fraud, the channel depends on the type of company involved and what outcome you want.
The PCAOB
The PCAOB accepts tips by email, phone (800-741-3158), or mail. You can report anonymously, though the Board encourages contact information so staff can follow up. Useful details include the individuals and firms involved, a description of the conduct, and supporting documents. The Board does not pay awards, and federal law bars it from disclosing what it does with a tip unless a public enforcement action results.16Public Company Accounting Oversight Board. Tips and Referrals The PCAOB may share tips with the SEC, state regulators, or foreign authorities.
The SEC Whistleblower Program
The SEC’s program pays. Eligible whistleblowers receive between 10% and 30% of monetary sanctions collected when their original information leads to a successful enforcement action producing penalties above $1 million.17U.S. Securities and Exchange Commission. Whistleblower Frequently Asked Questions The information must be original, meaning it comes from your own knowledge or analysis and was not already known to the SEC. Submissions go through the SEC’s online portal on Form TCR under penalty of perjury. Only individuals can qualify, not companies. For awards of $5 million or less without negative factors like personal involvement in the misconduct, there is a presumption of a 30% award.
Retaliation Protections
Section 806 of Sarbanes-Oxley makes it illegal for an employer to fire, demote, suspend, threaten, or otherwise retaliate against an employee who reports suspected securities fraud or audit violations to a federal agency, a member of Congress, or an internal supervisor.18United States Department of Labor. Sarbanes-Oxley Act (SOX) If retaliation happens, you can file a complaint with the Department of Labor or sue in federal court. Remedies include reinstatement, back pay with interest, and litigation costs and attorney fees. These protections cannot be waived through employment agreements or pre-dispute arbitration clauses.