Is Your Balance Sheet a Liability?

The SEC has decided to stop chasing every new trend and go back to the basics. They've launched a new Financial Reporting and Accounting Unit specifically to hunt for accounting fraud and disclosure failures. For most small firm owners, this sounds like noise—until you realize that "disclosure integrity" is just regulator-speak for "we're checking if your numbers actually match reality."

This is the most serious development this week because it signals a shift in appetite. The SEC isn't just looking for a few missing commas; they're returning to their roots as forensic accountants. If you’ve been relying on an accountant who treats GAAP as a set of suggestions rather than rules, you're now a target.

The logic is simple: it's easier to prove a number is wrong than to prove a "spirit" was violated.

You might think your firm is too small to attract the attention of a federal unit. That’s a mistake. Regulators don't always start with the whales; they often use smaller, clear-cut fraud cases to set quotas or signal to the rest of the market that the leash has tightened. If you're under-reporting liabilities to look better for a loan or an investor, the risk just spiked.

The second-order effect here hits your auditors. When the SEC starts flagging disclosure failures, audit firms get nervous. They’ll start pushing more work—and more fees—down to you to cover their own backs. Expect your next audit to be more intrusive and significantly more expensive as your auditor tries to avoid becoming a cautionary tale.

Then there's the vendor problem. The Midwest Spine and Brain Institute just got hit by ransomware, but not because they messed up their own servers. Their vendor did. Meanwhile, the FBI is digging through a breach at IDscan.net that exposed 153 million driving license records.

I hate seeing "due diligence" checklists that ask if a vendor has a security policy. A PDF that says "we value security" is worthless. It's a piece of digital wallpaper. The only thing that matters is whether they have an immutable backup and who actually holds the keys. If your critical data is sitting with a third party, you aren't "outsourcing risk"—you're just moving your neck under someone else's axe.

Speaking of leaks, Pocket Bitcoin lost KYC documents for over 5,000 customers. That’s the kind of breach that doesn't just result in a fine; it provides a roadmap for identity theft. It's a reminder that collecting data you don't absolutely need is just building a liability bonfire and waiting for a spark.

On the rule-change front, the Council of Europe is drafting AI privacy rules covering 55 nations. You'll see consultants trying to sell you "AI Governance Frameworks" starting tomorrow. Don't buy them. For a small firm, you don't need a framework; you need a spreadsheet. List every AI tool your staff is using, what data they're feeding into it, and whether that data is being used to train the model. That costs zero dollars and provides more actual protection than any expensive "readiness assessment."

Finally, there’s some minor relief: the SEC is proposing to scrap the pay-to-play rule for investment advisors. It's a rare win for administrative sanity.

The FBI investigation into those 153 million records shows that once data is out, it's out forever. No amount of "remediation" fixes a leaked driver's license. The only real control is not having the data in the first place. If you can't explain why you're keeping a specific piece of PII for more than 90 days, delete it.

Check your vendor list this week and find the one you trust the least. Ask them for the date of their last successful restore-from-backup test. Not the policy—the actual date.