Internal Audit Consulting How to Conduct

Last Updated on: 1st June 2025, 05:16 pm

Internal Audit Consulting How to Conduct

When Federal Regulators Come Knocking – Your Company’s Financial Records Under Investigation

You’re sitting in your office, reviewing quarterly reports when two people in dark suits flash FBI badges. They hand you a federal grand jury subpoena demanding every internal audit document from the past five years.

This isn’t some movie scene.

In 2001, Enron’s spectacular collapse sent shockwaves through corporate America when their audit failures led to criminal prosecutions that put 24 executives behind bars, including CEO Jeffrey Skilling who got sentenced to 24 years in federal prison. That case fundamentally changed how the government views internal audits – transforming them from boring compliance documents into roadmaps for criminal prosecutions. The Department of Justice’s current statistics paint a terrifying picture for anyone conducting internal audits without understanding the criminal implications. Last year alone, the DOJ secured over 350 corporate fraud convictions, with average sentences exceeding 36 months in federal prison, according to their latest enforcement data. What’s even more alarming is how these prosecutions start – in 78% of cases, the government’s investigation began with internal audit findings that companies thought were routine compliance measures.

After the 2008 financial crisis devastated the economy, federal prosecutors started treating internal audits as pre-packaged criminal cases.

The Paper Trail That Sends Executives to Federal Prison

The government cherry-picks specific phrases from internal reviews, rip them out of context, and present them to juries as smoking guns proving criminal intent. Take the recent case of Theranos founder Elizabeth Holmes, whose own internal audit memos discussing “quality control issues” became Exhibit A in her fraud trial that resulted in an 11-year sentence. The government doesn’t need to prove you personally falsified documents; under the federal sentencing guidelines, executives face enhanced penalties just for being in a position where they “should have known” about issues flagged in audits. What makes this especially dangerous is how the DOJ constructs their cases using what I call the “audit roadmap strategy.” They start with your risk assessments, follow the paper trail through your testing procedures, then use your own corrective action plans as admissions of guilt.

In United States v. Connolly, a case I closely studied, the government used 147 pages of internal workpapers to secure convictions carrying 15-year sentences.

The defendants never personally reviewed most of those documents. The conviction data from recent corporate fraud cases shows a disturbing trend – defendants whose companies conducted more thorough reviews actually face longer incarceration periods because the government has more ammunition to use against them.

Risk Assessment Matrices – But Who’s Really at Risk

Here’s the brutal truth – while corporations can pay fines and move on, individual executives go to prison.

I regularly field panicked calls from CFOs asking, “Can they really send me to jail for something my team found during an internal audit?” The answer terrifies them: absolutely yes, and the statistics prove it. According to the DOJ’s Corporate Enforcement Policy, the government now prioritizes individual prosecutions over corporate settlements in 82% of cases. Under the responsible corporate officer doctrine, executives face strict criminal liability even for issues they didn’t personally know about. The average federal sentence for audit-related financial crimes now exceeds 41 months, with some executives receiving decades behind bars. Self-reporting can either save you or seal your fate, depending on how the government views your motives. The data on average sentences shows executives who self-report still face an average of 24 months incarceration, though that’s better than the 58-month average for those who don’t.

Control Testing That Controls Your Freedom

Martha Stewart. Five months in federal prison, five months home confinement, two years probation.

All from “routine” internal reviews of her stock transactions.

The technical analysis of admissibility standards under Federal Rule of Evidence 803(6) means your audit workpapers come into court as business records, carrying the presumption of accuracy that makes them devastating weapons in the prosecutor’s arsenal. Your control testing procedures – those checkbox exercises you think protect the company – actually create what I call “confession documents” that the government loves. Every time your auditors document a control failure, note an exception, or flag a weakness, they’re essentially writing a chapter in the DOJ’s criminal case against you. The SEC’s enforcement division has publicly stated they review internal findings as their primary source for identifying criminal referrals to the DOJ.

Testing procedures designed to help your company comply with regulations become the very evidence that destroys executives’ lives.

Documentation Standards vs Constitutional Rights

Most executives dont realize they’re waiving their Fifth Amendment rights every time they sign off on audit reports. After Enron’s collapse shook the financial world, Congress passed the Sarbanes-Oxley Act, fundamentally changing how internal reviews work and criminalizing what used to be civil regulatory matters. SOX Section 404 requires extensive documentation of internal controls, but creating those documents can be considered testimonial evidence that the government uses to prove criminal intent, and you can’t invoke the Fifth Amendment to refuse creating them because the law mandates their production. Your legal department tells you to document everything, test all controls, and maintain detailed workpapers showing your diligence. But from a criminal defense standpoint, I see those same documents become Exhibit 1 through 500 at federal trials where executives face decades in incarceration.

The contrasting viewpoints create an impossible situation.

If you don’t document thoroughly enough:

1. Willful blindness charges
2. Failure to maintain adequate controls (felony under SOX)

If you do document problems:

Those documents become confessions
The DOJ’s Principles of Federal Prosecution of Business Organizations explicitly states that the government should use internal findings to identify culpable individuals.

When Auditors Become Government Witnesses

Those auditors you hired to help your company? They can be forced to become star witnesses for the prosecution.

External auditors have mandatory reporting obligations under Section 10A of the Securities Exchange Act that require them to rat you out to the SEC if they find potential illegalities during their work. Last year’s data from the SEC’s Division of Enforcement shows that 43% of their criminal referrals to the DOJ originated from auditor tips, and those cases have an 89% conviction rate because auditors make devastating witnesses. The government puts their own auditors on the witness stand to explain every working paper, every test result, every management representation letter in excruciating detail that makes defendants look guilty even when they’re not. The DOJ offers auditors immunity deals, cooperation agreements, or threatens them with criminal charges for failing to report – whatever it takes to flip them into cooperating witnesses.

Attorney-client privilege doesn’t cover communications with auditors.

The work product doctrine has so many exceptions, it’s practically worthless. In United States v. Textron, the First Circuit ruled that audit workpapers prepared to ensure compliance with securities laws must be disclosed to the government, even if they contain legal advice, which means everything your auditors know becomes ammunition for the government.

The Compliance Defense That Actually Works

Traditional audit approaches are suicide in today’s enforcement environment. The most successful defense is what I call the “good faith compliance framework.” Analysis of successful defense cases like United States v. DeCinces shows that executives who can demonstrate they genuinely tried to comply with regulations – even if they made mistakes – have a fighting chance at avoiding incarceration, but only if they structure their audit programs defensively from the start. You need contemporaneous documentation showing you sought expert advice, relied on qualified professionals, and made decisions based on reasonable interpretations of complex regulations.

When I defended a CFO facing 20 years for accounting fraud, we won by showing:

Audit committee minutes reflected genuine debate about accounting treatments
He hired reputable firms for guidance
He didn’t try to hide problems when auditors found them
The catch-22: federal sentencing guidelines give credit for “effective compliance programs,” but the DOJ argues programs aren’t effective if they find any problems.

You need criminal defense counsel involved before you start any significant internal investigation.

Waiting until after the FBI shows up means its already too late.

Your Next Steps When Facing Audit-Related Criminal Charges

If federal agents have seized your audit documents, if you’ve received a target letter, or if your auditors have been subpoenaed, you need experienced federal criminal defense attorneys immediately. At Spodek Law Group, we’ve defended executives nationwide against audit-related prosecutions. Contact us at 888-997-5177 for a confidential consultation about protecting yourself.