How Auditors Get Sanctioned: PCAOB, FRC, IRBA and APAS Compared
A cross-jurisdictional analysis of how independent audit oversight bodies discipline accounting firms for gross negligence, independence breaches, and workpaper alteration.
- Article: How Auditors Get Sanctioned: PCAOB, FRC, IRBA and APAS Compared
- Published: September 23, 2026 by Corporate Fraud Library Research Team
- Topics: Auditor Oversight, PCAOB, FRC, APAS, IRBA, Audit Failure
When public companies report fraudulent financial statements, attention naturally centers on the executives who orchestrated the deception. Yet behind almost every major corporate collapse lies an independent audit firm that failed to exercise professional skepticism, accepted unverified management spreadsheets, or compromised its independence.
Across the globe, independent audit oversight boards possess distinct statutory enforcement mechanisms to discipline audit firms and individual engagement partners.
1. United States: The PCAOB Disciplinary Framework
Established under Title I of the Sarbanes-Oxley Act of 2002 (SOX), the Public Company Accounting Oversight Board (PCAOB) oversees the audits of public companies and registered broker-dealers. The Board conducts regular inspections and prosecutes formal disciplinary proceedings through its Division of Enforcement and Investigations (DEI).
Under Section 105(c) of SOX, the PCAOB may impose:
- Permanent or temporary revocation of an accounting firm’s registration.
- Permanent or temporary bars prohibiting an individual from associating with any registered public accounting firm.
- Mandatory independent monitors and quality control remediation undertakings.
- Civil money penalties reaching up to $100,000 for individuals and $2,000,000 for firms for ordinary negligence, and up to $1,000,000 for individuals and $20,000,000 for firms for intentional or knowing misconduct.
The Board’s highest-profile enforcement action was the 2018 KPMG inspection leak scandal, in which former PCAOB staff leaked confidential lists of upcoming audit inspections to KPMG partners, resulting in a $50 million SEC settlement and criminal wire fraud convictions.
2. United Kingdom: The Financial Reporting Council (FRC)
In the UK, the Financial Reporting Council investigates statutory auditors under the Audit Enforcement Procedure (AEP) and the Accountancy Scheme. Unlike the PCAOB, which is an independent non-profit corporation, the FRC operates as an executive non-departmental public body with statutory powers delegated by Parliament under the Companies Act 2006.
The FRC utilizes an independent Disciplinary Tribunal headed by senior legal judges. When the Tribunal establishes audit misconduct, it levies uncapped financial penalties and issues exclusion orders barring individuals from membership in professional bodies like the Institute of Chartered Accountants in England and Wales (ICAEW).
In October 2023, the FRC imposed a record £21 million financial penalty on KPMG LLP for pervasive audit failures in its 2015 and 2016 audits of Carillion plc, while excluding lead audit partner Peter Meehan from the profession for ten years.
3. South Africa: The Independent Regulatory Board for Auditors (IRBA)
In South Africa, the Independent Regulatory Board for Auditors (IRBA) operates under the Auditing Profession Act of 2005. South Africa has been at the forefront of audit reform following the multi-billion-euro collapse of retail conglomerate Steinhoff International and the state capture scandals involving VBS Mutual Bank.
In response to public outrage over inadequate sanctions, the South African Parliament enacted the Auditing Profession Amendment Act in 2021, granting IRBA direct subpoena powers, search-and-seizure authority, and the power to impose uncapped administrative fines determined by the Minister of Finance.
4. Germany: APAS (Auditor Oversight Body)
Until the Wirecard scandal, Germany operated a fragmented two-tier enforcement system where audit oversight was handled by the Auditor Oversight Body (APAS), a discrete division within the Federal Office for Economic Affairs and Export Control (BAFA).
Under legacy German law, APAS was legally prohibited from publishing its disciplinary decisions in full, and maximum financial penalties against audit firms were capped at a nominal €500,000. In the wake of EY Germany’s decade-long failure to confirm Wirecard’s Philippine escrow bank balances, the Bundestag passed the Financial Market Integrity Strengthening Act (FISG) in 2021.
The FISG overhauled APAS, raised fine ceilings to €16 million, eliminated corporate secrecy restrictions, and mandated that APAS publicize all final sanctions on its official register.
Comparing Statutory Sanction Powers
| Regulator | Jurisdiction | Statutory Fine Ceiling (Firm) | Individual Practice Bar Authority | Publication Standard |
|---|---|---|---|---|
| PCAOB | United States | Up to $20,000,000 per violation | Permanent bar from registered firms | Full settled orders published on public docket |
| FRC | United Kingdom | Uncapped (Tribunal discretion) | Exclusion from ICAEW / ACCA | Full public reports and tribunal findings |
| IRBA | South Africa | Determined by Finance Minister | Revocation of auditor registration | Public disciplinary register |
| APAS | Germany | Up to €16,000,000 (post-FISG) | Exclusion from statutory audits up to 5 years | Published summary notices on official register |