The Ledger is Not a Suggestion

The SEC charged a New Jersey founder for running a Ponzi scheme worth just under $16 million; this is the worst part of the week. It shows the absolute bottom of audit failure, and millions don't vanish because of some weird accounting glitch. They disappear because someone looked at a spreadsheet and didn't check the cash.

I've been on both sides of this table; the people writing reports like to talk about process maturity. I don't care about that, and I care about what you can show me on a Tuesday afternoon without taking three days to pull logs. Here, the gap between the reported assets and the truth was a canyon.

Healthcare companies seem to treat patient data like a public utility. Veradigm is dealing with a breach of 3.5 million records. A third party caused it. Meanwhile, two different ransomware gangs stole 1TB of data from Interim HealthCare.

Most firms lie to themselves here. They treat vendor risk management as a checkbox. You send a form, the vendor checks every box, and you file it away. Could you show me evidence of that vendor's patch cycle for the last quarter right now? Probably not.

Compliance officers always bring up the SOC 2 report. It's their strongest shield. But a SOC 2 is just a snapshot of how things were supposed to work six months ago; it doesn't prove they work today. Your risk is only as low as the evidence you actually check.

The insurers will feel this next, and when 1TB of data leaves a building and records hit the dark web, premiums don't just go up. Insurers start asking for granular evidence that most firms can't find; auditors are next in line. They'll be asked why they signed off on a mature risk framework that couldn't stop basic credential theft.

Where Food Comes From had to address a material weakness in its lease accounting. It sounds boring. But a material weakness is just a public admission that your internal controls are broken, and why can't you get lease accounting right? It's mostly a math problem, and when that happens, regulators start wondering what else is hidden in the books.

GeoVax is feeling similar stress with its Nasdaq compliance plan. Once you lose the trust of the regulator or the exchange, paperwork isn't about governance anymore. It's about survival.

The SEC isn't playing around with subpoenas either, as seen in their move to compel documents from ISS. They want the raw data, not the curated summary.

Take a look at your third party attestations; if your vendor disappeared tomorrow, could you actually prove they were secure? Or are you just clutching a PDF where they promised they were.

One is compliance; the other is evidence.