CPA Defense Lawyer for Audit and Attestation Allegations
When an Audit or Attestation Engagement Is Questioned, the Applicable Standard and the Original Work Matter.
A Certified Public Accountant facing allegations of deficient audit work, inadequate evidence, improper attestation procedures, insufficient documentation, or an unsupported professional report may also face questions about the CPA's license or authority to practice.
These allegations can arise from client complaints, peer reviews, regulatory inspections, civil litigation, employer investigations, or an inquiry by a state board of accountancy. The legal consequences depend on the engagement, the professional standards actually applicable to the work, and the regulator's authority.
Ratliff Jackson LLP represents CPAs and accounting professionals in professional licensing and disciplinary matters involving alleged audit and attestation deficiencies. We evaluate the specific criticism, the applicable technical standards, the engagement record, and any related proceedings before developing a response.
A Technical Audit Complaint Requires More Than a General Explanation
The first objective is to identify the particular engagement, the allegedly deficient procedures, and the standard against which the work is being measured.
An initial response should account for the distinction between a peer review comment, an internal quality finding, a regulatory request, and a formal disciplinary charge. These documents may concern the same engagement but do not necessarily have the same legal significance.
Identify the Issuing Authority and Procedural Stage
Determine whether the matter involves a state accountancy board, a peer review administrator, a PCAOB inspection or investigation, the SEC, an employer, or a client. Review the notice for requested action, applicable deadline, and any identified professional standards.
Determine the Engagement Type
Establish whether the work was a financial statement audit, attestation examination or review, agreed-upon procedures engagement, financial statement review, compilation, or another service. The professional obligations are not interchangeable.
Preserve the Original Engagement File
Identify engagement letters, risk assessments, workpapers, audit evidence, review notes, consultations, confirmations, electronic files, communications, and reports. Retain the original documentation and any relevant electronic history.
Identify the CPA's Individual Responsibilities
Determine who planned the engagement, performed procedures, supervised staff, reviewed findings, resolved issues, and signed or authorized the report. Firm responsibility and individual professional responsibility may raise distinct questions.
Evaluate Parallel Proceedings Before Responding
Consider whether the same work is being examined in civil litigation, an employer investigation, peer review, a federal regulatory proceeding, or another state licensing matter. Coordinate factual positions and legally required responses across the relevant proceedings.
Audit and Attestation Deficiencies That Can Raise Licensing Questions
An allegation of inadequate professional work must be connected to a specific engagement responsibility and an applicable standard. The nature of the deficiency determines what evidence and technical analysis are needed.
Insufficient Audit Evidence
An investigator or reviewer may question whether the procedures performed produced sufficient appropriate evidence to support a material assertion or the auditor's opinion.
The response may require examining identified risks, testing, confirmations, analytical procedures, other evidence, and the conclusions documented.
Inadequate Risk Assessment
Allegations may concern unidentified risks of material misstatement, insufficient understanding of internal controls, or audit procedures that did not adequately respond to assessed risks.
The engagement plan, changes during the audit, and contemporaneous assessments may be central.
Deficient Audit Workpapers
Workpapers may be criticized for missing procedures, incomplete explanations, unclear conclusions, insufficient review documentation, or failure to record significant matters.
Documentation requirements must be evaluated under the standards applicable to the engagement and reporting period.
Unsupported Audit Opinions
A complaint may allege that a report was issued without a sufficient evidentiary basis, used an inappropriate opinion, or failed to address information relevant to the report.
Professional reporting requirements, the actual audit findings, and the final report must be reviewed together.
Attestation Procedure Failures
Questions may arise concerning examination procedures, suitable criteria, agreed-upon procedures, engagement scope, evidence, or the reporting obligations established by applicable attestation standards.
The work must be evaluated according to the particular attestation engagement, not automatically under financial statement auditing standards.
Supervision and Review Deficiencies
A CPA may be questioned about insufficient direction, review, consultation, engagement quality responsibilities, or oversight of staff performing significant procedures.
The individual's actual role and the governing competence and supervision requirements matter.
Professional Skepticism
A reviewer may allege that contradictory information was overlooked, management representations were accepted without adequate support, or indications of possible misstatement were not appropriately evaluated.
Contemporaneous judgments, procedures performed, and the information available at the time should be examined.
Independence and Objectivity
Some engagement concerns involve a financial, employment, business, or personal relationship allegedly impairing independence or professional objectivity.
The applicable independence framework and engagement type determine which restrictions and safeguards are relevant.
Peer Review and Quality Findings
Firm reviews may identify deficiencies involving audit planning, documentation, monitoring, financial statement review procedures, reports, or other quality management issues.
The review findings, any required remediation, and potential state regulatory consequences must be distinguished.
Audit, Attestation, and Review Engagements Are Not Governed by One Uniform Standard
A CPA defense begins with the type of work performed. The standards applicable to a nonissuer audit can differ materially from those governing a separate attestation engagement, a financial statement review, or a public-company audit.
It is also necessary to identify the version of the standard applicable to the relevant engagement period. Subsequent changes do not necessarily govern work performed before their effective dates.
AICPA Auditing Standards
For nonissuer financial statement audits conducted under generally accepted auditing standards, the AICPA's Statements on Auditing Standards are organized in the AU-C sections.
Depending on the allegation, relevant standards may concern risk assessment, audit evidence, documentation, use of specialists, supervision, conclusions, or reporting.
Statements on Standards for Attestation Engagements
The AICPA's attestation standards, codified in the AT-C sections, govern covered attestation engagements such as certain examinations, reviews, and agreed-upon procedures.
The nature of the subject matter, applicable criteria, agreed procedures, evidence, and report determines the relevant requirements.
Preparation, Compilation, and Review Services
Financial statement preparations, compilations, and reviews ordinarily fall under applicable Statements on Standards for Accounting and Review Services, codified in the AR-C sections.
These services have different requirements and assurance characteristics. A compilation should not be described as a financial statement audit.
PCAOB Auditing Standards
Audits within PCAOB jurisdiction are governed by the standards applicable to that work, including the Board's requirements concerning audit evidence, documentation, supervision, and reporting.
A PCAOB inspection or disciplinary matter is a distinct federal process. Whether it also produces state licensing exposure depends on the relevant state law and circumstances.
For example, a government audit may implicate generally accepted government auditing standards and other legally applicable requirements. The presence of an audit report alone does not establish which entire body of standards controls the engagement.
What Does the Engagement Record Actually Establish?
A technical criticism should be tested against the actual work, the applicable requirements, the evidence available at the time, and the professional judgment exercised during the engagement.
1. Which Requirement Was Allegedly Violated?
Identify the specific standard, reporting requirement, or licensing provision asserted. A general conclusion that an audit was deficient is not a substitute for analyzing the conduct required by the relevant rule.
2. What Was the Engagement Scope?
Review the engagement agreement, subject matter, reporting objective, period covered, agreed responsibilities, and services actually performed.
3. What Evidence Was Obtained?
Consider confirmations, reconciliations, testing, analytical procedures, inquiries, inspection of supporting materials, and the reliability and sufficiency of evidence for the relevant assertions.
4. How Were Significant Judgments Documented?
Examine risk assessments, materiality decisions, professional consultations, identified inconsistencies, review comments, and the basis for conclusions reached.
5. Who Performed and Reviewed the Work?
Evaluate the responsibilities of the engagement partner, signing CPA, staff, specialists, reviewers, and accounting firm under the particular standards and licensing law.
6. What Does the Alleged Deficiency Actually Prove?
Distinguish inadequate documentation, insufficient procedures, an unsupported conclusion, gross negligence, and intentional misconduct. The legal significance of each depends on the governing provision and evidence.
Records That May Be Central to an Audit or Attestation Defense
Audit and attestation matters are often document-intensive. Proper review should preserve the original file and connect each alleged deficiency to the records relevant to the engagement.
Engagement Letters and Reports
Agreed services, scope, dates, responsibilities, report language, deliverables, and communications concerning the work.
Risk and Materiality Assessments
Planning memoranda, identified risks, materiality decisions, control understanding, and subsequent changes in audit strategy.
Testing and Supporting Evidence
Selections, confirmations, analytical procedures, substantive testing, reconciliations, schedules, and supporting financial data.
Documented Conclusions
Workpaper files, audit programs, significant matters, exceptions, identified misstatements, final evaluations, and report support.
Supervision and Review Records
Assignments, engagement review documentation, consultations, reviewer comments, resolution of disagreements, and signoffs.
Peer Review and Inspection Records
Review reports, deficiency descriptions, correspondence, responses, required corrective actions, and evidence of remediation.
Preserve original files, relevant metadata, electronic histories, and supporting records. Documentation completion, retention, and permissible later additions are governed by the applicable professional and legal requirements. Any clarification or supplemental record must be handled consistently with those requirements.
A Peer Review Finding or PCAOB Inspection Deficiency Is Not Automatically Final Discipline
Quality reviews, inspections, investigations, and formal disciplinary proceedings serve different purposes. Understanding which process produced the finding is essential before assessing the licensing consequences.
CPA Firm Peer Review
A peer review may evaluate a firm's accounting and auditing practice and compliance with applicable professional standards.
Findings may concern audit planning, performance, documentation, engagement reporting, firm monitoring, or other quality matters.
State law may require enrollment, submission of specified reports, remediation, or other action. A peer review rating is not automatically a final individual-license disciplinary finding.
PCAOB Inspections
The Public Company Accounting Oversight Board conducts inspections of registered public accounting firms within its jurisdiction.
An inspection deficiency may identify concerns about audit performance, documentation, or quality systems. The PCAOB explains that an inspection finding is not an adjudicated disciplinary determination.
A separate enforcement matter may arise when supported by the circumstances and governing law.
The PCAOB expressly distinguishes most reported inspection deficiencies from conclusions that an issuer's financial statements are materially misstated. An audit deficiency can nevertheless warrant significant review or additional regulatory attention, depending on the facts and applicable law.
Defending Technical Audit and Attestation Allegations
The defense must connect the technical criticism to the governing rule and the evidence. Counsel's role includes determining the regulatory significance of the allegation and coordinating the response to each relevant authority.
Identify the Regulatory Proceeding
We review the notice, issuing authority, procedural stage, deadlines, alleged violations, and whether the matter concerns licensing, peer review, inspection, or a separate federal proceeding.
Determine the Applicable Standards
We identify the relevant engagement type, professional standards, state licensing provisions, and versions of the rules applicable to the period under review.
Review the Engagement Evidence
We evaluate engagement terms, workpapers, supporting evidence, communications, documented judgments, supervision, and review history. Appropriate technical expert review may be considered.
Develop a Supported Response
We address alleged deficiencies through factual and legal analysis, written responses, investigator communications, document-production issues, and preparation for interviews or conferences where applicable.
Prepare for Formal Action
If disciplinary charges or proposed agreements arise, we assess the evidence, hearing procedures, disputed findings, potential sanctions, and available resolution options.
Address Related Professional Exposure
We evaluate potential effects on state licenses, firm registration, federal audit practice, civil litigation, professional association matters, and any available review or appeal process.
The right response to a questioned audit is not necessarily the right response to an attestation examination, peer review finding, or PCAOB enforcement matter. Each must be evaluated according to the authority and standards governing that process.
How an Audit Deficiency May Become a Licensing Matter
A state board may learn of questioned accounting work through a client complaint, a peer review report, another regulator, civil litigation, or other information. Whether the matter advances depends on the regulator's authority and the evidence.
Complaint or Information Received
The licensing authority receives information and may assess whether the alleged conduct falls within the accountancy law and the board's jurisdiction.
Review of the Engagement
The authority may request records, obtain explanations, consult technical materials, or investigate specific work and professional responsibilities under the applicable rules.
Evaluation of Alleged Violations
The regulator determines whether the record supports further action under a specific statutory or regulatory ground. A technical finding should not be confused with a final disciplinary determination.
Possible Closure, Agreement, or Formal Charge
Depending on the jurisdiction and circumstances, a matter may close, continue under review, result in a proposed resolution, or proceed through formal administrative charges.
Decision and Available Review
Where formal discipline is imposed, the authority's powers, procedural rights, appeal routes, and potential reinstatement or compliance requirements are governed by the applicable jurisdiction's law.
Audit and Attestation Allegations Under State Accountancy Law
State boards determine licensing consequences under their own statutes and regulations. Professional standards become legally significant in the manner provided by the applicable regulatory framework.
State Board of Accountancy
New Jersey regulates CPA practice through the Accountancy Act and N.J.A.C. 13:29.
N.J.A.C. 13:29-3.5 addresses applicable generally accepted auditing standards and, where applicable, generally accepted government auditing standards. Other professional conduct and licensing provisions may also be relevant.
The specific engagement, alleged departure, applicable standards, and state disciplinary authority must be examined before determining potential license consequences.
New Jersey License Defense →State Board of Accountancy
49 Pa. Code § 11.27 addresses auditing standards and compliance with other applicable technical standards.
Section 11.23a separately establishes competence requirements for supervising attest services and signing or authorizing attest reports, including experience, continuing education, or qualifying firm-related criteria.
The CPA Law provides separate grounds for disciplinary action. A complaint requires analysis of the actual conduct and provision invoked.
Pennsylvania License Defense →California Board of Accountancy
California Business and Professions Code § 5100(c) addresses specified dishonesty, fraud, gross negligence, or repeated negligent acts resulting in violations of applicable professional standards.
Section 5076 establishes peer review requirements applicable to covered firms and authorizes board action arising from qualifying complaints or peer review information.
A failed peer review, alleged standards violation, and formal disciplinary finding should be distinguished.
California License Defense →Other licensing jurisdictions may have different rules governing auditing standards, attest engagement qualifications, peer review, firm registration, and reporting. The relevant board and legal provisions must be evaluated separately.
If an audit-related disciplinary action affects several CPA credentials, review our Multi-State License Defense and National Board Actions practice.
What Can Be at Stake Beyond the Audit Report?
The consequences of an alleged audit or attestation deficiency depend on the legal forum, the nature of the findings, and any subsequent disciplinary action.
Individual CPA License
Applicable state law may authorize reprimands, fines, education requirements, restrictions, suspension, revocation, or other measures if a qualifying violation is established through the required process.
Accounting Firm Registration
Some findings may affect firm registration, peer review obligations, audit eligibility, quality management procedures, or requirements for corrective action.
PCAOB Enforcement
Accountants and registered firms within PCAOB jurisdiction may face separate enforcement proceedings. PCAOB sanctions and state CPA license discipline arise under different legal authorities.
SEC Practice
Some accounting matters may also implicate the Securities and Exchange Commission's authority over professionals appearing or practicing before it. That authority is separate from state board licensure.
Civil Malpractice Claims
A client or third party may pursue a civil claim arising from the same engagement. Civil claims, professional standards disputes, and state licensing discipline have different legal elements and procedures.
Other State Licenses
Formal action involving one license or regulatory body may create disclosure or reciprocal discipline questions in another jurisdiction. Those consequences are not automatically identical across states.
Official Audit, Attestation, and Accountancy Resources
These resources distinguish professional standards, regulator authority, inspection findings, and state licensing requirements. The appropriate source depends on the type of engagement and the agency examining it.
Currently Effective Auditing Standards
Find AICPA Statements on Auditing Standards organized by AU-C sections, including general responsibilities, risk assessment, audit evidence, and reporting.
Attestation Standards Explained
The AICPA's attestation materials explain the purposes and applications of Statements on Standards for Attestation Engagements.
Preparation, Compilation, and Review Standards
Understand the separate SSARS framework for preparing, compiling, and reviewing financial statements.
AS 1215: Audit Documentation
Review PCAOB requirements for audit documentation, review responsibilities, evidence, and the record supporting conclusions. Check the effective dates of amendments.
How PCAOB Inspections Work
Learn what an inspection deficiency indicates, how inspection reports are used, and why those findings are distinct from disciplinary adjudications.
PCAOB Disciplinary Proceedings
Review the PCAOB's separate enforcement authority, settlements, disciplinary orders, and publicly available final actions.
State Board of Accountancy Regulations
Find official access points for New Jersey's Accountancy Act, professional conduct regulations, and licensing enforcement framework.
49 Pa. Code Chapter 11
Review Pennsylvania regulations concerning technical standards, competence to supervise attest services, peer review, and professional conduct.
California Board of Accountancy Laws and Rules
Find the Accountancy Act, regulations, and relevant statutory provisions addressing professional standards and peer review.
CPA Audit and Attestation Allegations
These answers provide a general framework. The controlling rules, deadlines, hearing procedures, and licensing consequences depend on the specific engagement and jurisdiction.
Can a CPA lose a license because of audit deficiencies?
Potentially. State accountancy laws may authorize discipline when deficient audit work establishes a violation of applicable professional standards or other disciplinary grounds. A deficiency finding alone does not automatically establish a violation or result in license suspension or revocation.
Does a failed peer review automatically cause CPA license discipline?
No. The regulatory significance of a failed peer review depends on the state's peer review requirements, the findings, reporting obligations, and any further proceedings. A state board may review a peer review report or require action without the review rating itself being a final disciplinary order.
Is inadequate audit documentation proof that the financial statements were wrong?
No. Documentation deficiencies and material financial statement misstatements are different issues. A documentation finding may raise serious questions about work performed or conclusions reached, but it does not automatically establish that the financial statements were materially misstated.
What is the difference between audit and attestation standards?
Financial statement audits of nonissuers are generally governed by applicable auditing standards, including the AICPA's AU-C framework. Covered attestation engagements may be governed by the AICPA's AT-C framework. Financial statement preparations, compilations, and reviews ordinarily involve separate AR-C standards. The actual engagement determines which requirements apply.
Can an engagement partner face discipline for work performed by staff?
Potentially, depending on the professional's supervisory duties, the applicable standards, the person's actual role, and the licensing law. The review should examine assignments, procedures performed, supervision, engagement reviews, significant judgments, and the responsibilities of the signing or supervising CPA.
Does a PCAOB inspection deficiency automatically affect my state CPA license?
No. PCAOB inspections and state CPA licensing proceedings are distinct processes. Whether an inspection finding or later PCAOB disciplinary action creates state licensing consequences depends on the relevant state law, reporting requirements, facts, and any action taken by the appropriate authority.
Should I supplement audit workpapers after receiving a board complaint?
Do not alter historical records merely to improve the appearance of the engagement file. Preservation, documentation completion, and permissible additions are governed by the standards and legal requirements applicable to the work. Counsel should evaluate any legitimate clarification or supplemental documentation while ensuring the original record is preserved.
Can a civil audit malpractice lawsuit and a board investigation proceed together?
Yes. Civil litigation and state licensing proceedings are separate processes that may examine overlapping conduct and records. Statements, expert analysis, document production, and proposed settlements should be evaluated for their possible effect on each proceeding.
What does a CPA defense lawyer do in an audit or attestation case?
Counsel can review the allegation and governing law, identify applicable professional standards, evaluate engagement documentation, address information requests and investigator communications, prepare written responses, assess technical expert evidence, and represent the CPA in appropriate disciplinary proceedings. Related federal, civil, firm, and multi-state matters may also require analysis.
Before You Defend the Audit Opinion, Understand the Allegation and the Standard.
A questioned audit or attestation engagement may involve technical accounting standards, the engagement file, professional supervision, peer review findings, and potential licensing consequences.
If a board, investigator, peer review authority, or federal regulator has contacted you about alleged audit or attestation deficiencies, Ratliff Jackson LLP can evaluate the notice, relevant records, and available response options.