The risk of pulling an audit opinion

The most serious action this week involves PLDT Inc. and a messy retreat from its 2025 Form 20-F. When a company has to amend its primary SEC filing because of material control weaknesses—and when auditors pull their opinions entirely—it isn't just a bookkeeping error. It is a systemic collapse.

The technical failure here sits within the internal controls over financial reporting. But for those of us watching data governance, this is a proxy for everything else. If a firm cannot maintain a reliable trail of evidence for its financial disclosures to the point that its auditors walk away from their own signatures, it’s safe to assume the "privacy by design" claims in its brochures are fiction. You can't have a secure data perimeter when you don't even have a secure ledger.

The implication is immediate: the trust gap now extends beyond the SEC. When audit opinions are withdrawn, the company isn't just fighting with regulators; it’s admitting that the machinery used to generate its truth is broken.

The usual defense is that financial controls and data privacy controls are different animals. One tracks dollars; the other tracks PII. That is a convenient lie. Both rely on the same operational hygiene: access logs, change management, and an honest inventory of where data lives. If you can't prove who changed a line in a financial report, you certainly can't prove who accessed a database of customer records.

The second-order effect here hits the auditors first. The firms that originally signed off on PLDT’s books are now staring at a massive professional liability risk. They'll likely tighten their requirements for every other Philippine-based issuer, demanding more granular evidence and less reliance on management's "assertions." This means a sudden, painful increase in audit friction across the region.

It is a stark contrast to the performative nature of certification.

Take the Medusa ransomware group. They’ve hit north of 500 critical infrastructure organizations. The sheer volume suggests that many of these entities had the right certificates on the wall but lacked the actual operational controls to stop a known threat actor.

Then there is Flock Safety. While the company is tightening its camera policies following privacy concerns, we saw an Itasca police officer lose his job for misusing license plate reader technology. This is where "policy" meets reality. A policy update from a vendor is a piece of paper; an employee using a surveillance tool for personal reasons is a failure of oversight.

Updating a handbook doesn't fix a culture that treats powerful surveillance tools as toys. The real question isn't whether the policies are "tight," but whether there was any actual monitoring of the people using the cameras. If you aren't auditing the auditors, you're just waiting for the next headline.

On the smaller end of the scale, the Data Protection Office in Kenya ordered the board of Mukumu Girls school to pay a fine of 300,000 shillings over a privacy breach. It’s a modest sum, but it's an important signal. It shows that regulators are moving past the "big fish" and starting to penalize institutions that treat student data with indifference.

We also see the SEC charging former executives at Tricolor for fraud and falsifying loan documents. This wasn't a failure of a system; it was a deliberate choice to lie. In these cases, the fine isn't for "non-compliance"—it's for dishonesty.

The common thread this week is the gap between what a company says it does and what it actually does. Whether it’s an amended 20-F or a misused license plate reader, the failure is always the same: a reliance on paperwork over practice.

I want to see if any of these firms actually implement a "deny by default" access model for their sensitive systems. Until then, they're just rearranging the furniture in a house with no locks.

The SEC is also proposing new rules for crypto issuers to raise capital more flexibly. This will likely create a surge in new filings that will be desperately thin on actual control documentation.

Watch the auditors' reaction to those new proposals. If they start demanding independent third-party attestations before signing off, we'll know they've finally stopped trusting the brochures.