The utility of the professional scapegoat

The SEC has decided that the best way to combat accounting fraud is to build a dedicated unit specifically designed to hunt CPAs. On paper, it's a move towards accountability. In practice, it's an admission that the regulator would rather penalise the person who signed the form than dismantle the systemic incentives that lead to the fraud in the first place.

Compliance conventional wisdom suggests that "dedicated enforcement units" signal a new era of rigour. We are told that by focusing resources on the gatekeepers, the auditors and accountants, the rest of the market will instinctively tighten its belt. It is the logic of the lighthouse: if you make the rocks visible enough, ships will stop hitting them.

But follow the paperwork, and the logic frays.

The SEC is simultaneously increasing scrutiny of AI governance and wrestling with climate reporting rules that Norway's sovereign wealth fund, managing just over $1.6 trillion, is already fighting. While the regulator chases the ghost of "AI ethics" and argues over carbon footnotes, it has created a streamlined pipeline for blaming the professional service provider.

It is far simpler to prove a CPA failed to exercise due professional care than it is to prove a C-suite executive intentionally manipulated earnings through complex revenue recognition schemes. The former is a failure of process; the latter is a crime of intent. By creating a unit focused on the auditor, the SEC isn't necessarily stopping more fraud. It is simply refining its target list.

The result won't be cleaner books. Instead, we will see an explosion of defensive documentation.

Auditors will spend less time actually auditing and more time producing evidence that they followed every possible checklist to avoid becoming a headline in the new unit's quarterly report. When the goal shifts from "finding the error" to "proving I didn't miss it," the quality of the audit doesn't improve; it just becomes more expensive.

One might argue that this is a necessary deterrent. The idea is that if CPAs fear the SEC, they will push back harder against corporate clients.

This assumes that the power dynamic between a mid-tier audit firm and a multi-billion dollar client is balanced. It isn't. In reality, this creates a secondary crisis: the "audit desert." If the regulatory risk of signing off on a complex balance sheet outweighs the fee, auditors will simply stop taking on mid-cap clients. They'll retreat to the safest, largest firms where the internal controls are already institutionalised and the risk is distributed across a thousand assistants.

The downstream effect hits the insurers first. Professional indemnity premiums for CPAs will climb as the "dedicated unit" turns into a revenue stream for the regulator. Then it hits the firms who find themselves unable to source an auditor willing to take the risk.

The irony is that while we obsess over these professional gatekeepers, the actual perimeter of data security remains porous. This week, Unlimited Technology Systems leaked the medical records of just under 4 million patients. That isn't a failure of a CPA's signature; it's a fundamental collapse of basic security hygiene. Yet the regulatory energy is spent on creating new units to hunt accountants rather than enforcing the boring basics of data protection.

Even when regulators do win, they tend to go for the low-hanging fruit. TikTok just lost a preliminary appeal over a £12.7 million fine regarding child privacy in the UK. It's a tidy sum, but it's a predictable outcome of a clear rule breach. Hunting CPAs is an attempt to make the complex look predictable.

We are seeing a trend where "governance" is becoming a substitute for actual oversight. The SEC wants AI governance; the FTC is simultaneously dropping its pursuit of disparate-impact claims. We are essentially being told to build fancy fences around our algorithms while the regulator stops caring if those algorithms actually discriminate against people in the real world.

If you want to know if this new unit actually works, don't look at the number of fines issued to CPAs. Look at whether corporate executives start spending more time on their own internal controls and less time relying on the "certified" stamp as a legal shield.

Until then, the new unit is just a faster way to find someone to blame when the music stops. I suspect the filing deadlines for those under investigation will be the only thing that remains strictly punctual.