If you're a small or mid-sized company preparing for a bank loan renewal, an SBA-backed acquisition, or a minority-stake sale, there's a good chance someone in that deal is going to ask for audited financial statements. And there's an even better chance you'll never think to ask a single question about the audit firm itself — you'll just assume that if a CPA signs the opinion letter, the numbers behind it were actually checked.
That assumption just got a lot shakier.
In December 2025, the Public Company Accounting Oversight Board (PCAOB) sanctioned Jennifer A. Crofoot, CPA, and her former firm, Fruci & Associates II, PLLC, a Spokane, Washington-based audit shop, for a string of failures across four public company audits. The headline violation is one most business owners have never heard of: Crofoot signed off on "clean" audit opinions without getting the mandatory second set of eyes — a concurring approval from an engagement quality reviewer — and, in some cases, without performing adequate audit procedures on material accounts at all.
She's now barred from associating with any PCAOB-registered firm for at least three years. Fruci & Associates was censured and fined $50,000. Neither penalty undoes the four audits that already went out the door with an unqualified opinion attached.
Here's what actually happened, why it matters even if you'll never touch a public company audit, and the questions it should teach you to ask before you rely on someone else's audited numbers.
What the PCAOB found
According to the PCAOB's December 18, 2025 order, Crofoot served as the engagement partner on audits of four companies — Clean Vision Corp, Hammer Fiber Optics Holdings Corp, LeeWay Services, and Zeuus. Across those engagements, the order describes two categories of misconduct:
She authorized unqualified opinions without adequate audit evidence. For material accounts on the financial statements, the order found she performed insufficient audit procedures — and in some instances, none at all. An unqualified opinion is the "clean bill of health" version of an audit report: it tells investors, lenders, and business partners that the financial statements are free of material misstatement. Issuing that opinion without doing the underlying work is close to the worst thing an auditor can do, because everyone downstream treats the opinion as a verified fact rather than an assertion.
She skipped the required engagement quality review. PCAOB standards (AS 1220) require a second, independent reviewer — someone not on the audit team — to evaluate the significant judgment calls the engagement team made before the firm is allowed to release the report. That reviewer has to sign off, in writing, before the audit opinion can go out. Crofoot's audits went out without that concurring approval.
On the firm side, the PCAOB found that Fruci & Associates had its own quality control failures — specifically around audit documentation and engagement performance — and that those firm-level gaps "impaired the firm's ability to prevent or detect" what Crofoot was doing. In plain terms: a functioning quality control system should have caught this before four opinions shipped without a second reviewer's sign-off. It didn't.
The sanctions: Crofoot is censured and barred from the profession for a minimum of three years, after which she can petition for reinstatement only if she completes 40 hours of PCAOB-approved continuing education. Fruci & Associates is censured and pays a $50,000 civil penalty, plus required remedial actions to its quality control system.
Why the engagement quality review exists
It's easy to read "missing a required sign-off" as a paperwork violation. It isn't. The engagement quality reviewer is a structural check built specifically to catch the failure mode that happened here: an engagement partner who is too close to the client, too rushed, or too willing to accept management's explanation without pushing for evidence.
The reviewer doesn't redo the audit. They evaluate the calls the team already made — did the team get enough evidence for the revenue recognition conclusion, did they push back hard enough on an aggressive estimate, does the overall opinion hold up. Then they either concur or they don't, and the firm isn't allowed to release the report until they do.
Skip that step, and the only thing standing between "adequate work" and "an opinion nobody actually checked" is the judgment of the one person who might be under the most pressure to sign off — the partner managing the client relationship. That's exactly the gap this case fell into.
Why this should matter to a small business, not just public company investors
Most readers of a small business finance blog aren't PCAOB-registered issuers, and most small businesses aren't required to have a PCAOB audit at all. So why does an enforcement order about four public companies in Spokane matter to you?
Because the underlying lesson — an audit opinion is only as good as the process that produced it — applies well beyond PCAOB's jurisdiction. Small and mid-sized businesses regularly hand audited or reviewed financial statements to people making real decisions:
- A bank evaluating a loan renewal or covenant compliance relies on your CPA's opinion to size risk and set terms.
- A buyer in an acquisition uses audited financials as the starting point for valuation and representations in the purchase agreement.
- An investor considering a minority stake treats a clean audit as a baseline signal of financial hygiene.
- A franchisor, landlord, or major supplier may condition a relationship on audited or reviewed statements meeting a threshold.
In every one of those situations, you are asking a counterparty to trust a CPA firm's work product on your behalf. If that firm's internal controls are weak enough that a partner can skip a mandatory second review four times before anyone catches it, the "clean opinion" you're both relying on may not mean what either of you assumes it means.
How to actually vet an auditor before you rely on their opinion
You don't need to be a PCAOB inspector to do meaningful diligence on an audit or review firm. A few concrete steps:
1. Check PCAOB registration and inspection history — even for non-issuer audits. If your CPA firm is PCAOB-registered (common among firms that also serve public or pre-IPO clients), the PCAOB publishes the public portion of every inspection report and every enforcement order at pcaobus.org. Search the firm's name before you sign an engagement letter, not after you've already relied on their opinion for a financing decision.
2. Ask who performs the engagement quality review — and confirm it's independent. For any audit above the smallest scale, ask directly: who is the engagement quality reviewer, and are they independent of the engagement team and the client relationship? A firm that can't answer this clearly, or that treats it as a formality, is telling you something about its quality control culture.
3. Read the actual scope, not just the opinion letter. An audit, a review, and a compilation are three different levels of assurance, and the difference matters enormously to a lender or buyer relying on the number. Confirm in writing which one you're getting, and make sure the engagement letter specifies the procedures performed on your highest-risk accounts (usually revenue recognition, inventory, and any material estimates).
4. Don't treat "clean opinion" as synonymous with "verified." As this case shows, an unqualified opinion can be issued even when the underlying audit evidence is thin — the whole point of enforcement action is that the failure is usually invisible from the outside until something goes wrong or a regulator looks closely. A clean opinion is a strong signal, not an absolute guarantee.
5. For high-stakes transactions, consider a second opinion. If you're about to close a sale, a major financing round, or an acquisition based substantially on audited numbers, it's reasonable to have your own accountant or a transaction advisor sanity-check the financial statements independently — the same way a buyer's attorney reviews a seller's contracts rather than taking the seller's counsel's word for it.
Keeping your own books audit-ready, whoever ends up checking them
None of this is about distrust of the accounting profession — PCAOB enforcement actions like this one exist precisely because the system is designed to catch failures and hold firms accountable when the internal checks break down. But it's a reminder that the numbers your auditor is opining on start with you.
The best defense against a weak or rushed audit isn't just picking the right firm — it's giving any auditor a clean, well-documented set of books to work from in the first place. Plain-text accounting with Beancount.io keeps every transaction in a version-controlled, human-readable ledger, so there's a complete, auditable trail behind every number long before an auditor — or a lender, or a buyer — ever looks at it. Get started for free and make sure your financial records can stand up to real scrutiny, not just a signature.