Imagine hiring an inspector to certify your building is structurally sound, only to later discover he photocopied last year's report, crossed out the old inspector's name, wrote in his own, and signed off without ever climbing the stairs. That is, almost word for word, what a federal audit regulator says happened inside a small accounting firm's file room — and it has lessons for any small business that leans on someone else's audited numbers.
On January 13, 2026, the Public Company Accounting Oversight Board (PCAOB) announced settled disciplinary orders against Zwick CPA, PLLC, its owner Jack Zwick, and former audit manager Jeffrey Hoskow over their 2022 audit of Genie Energy Ltd. The most striking finding: Hoskow allegedly took the predecessor auditor's workpapers, swapped in "Zwick CPA" for the old firm's name, updated the year under audit, and added fresh sign-offs — then padded the file with other documentation that referenced entirely different, unrelated companies. None of it, according to the PCAOB, reflected actual audit work performed on Genie Energy that year.
You don't need to run a publicly traded company to care about this story. Most small-business owners will never be audited by a PCAOB-registered firm themselves — but plenty rely, directly or indirectly, on someone else's audit: a bank evaluating a loan applicant's financials, a franchisor's or supplier's audited statements, an acquisition target's books during due diligence, or an insurance carrier's public filings before you sign a policy. When the audit behind those numbers turns out to be theater, the risk quietly becomes yours.
What the PCAOB Actually Found
The PCAOB's order lays out a cascade of failures, not just the workpaper substitution:
- Inadequate risk assessment. The firm allegedly failed to properly plan the engagement or identify and assess the risks of material misstatement — the foundational step of any audit.
- Insufficient evidence on internal controls and revenue. Auditors are supposed to gather enough appropriate evidence to support their opinion. The order found the firm fell short on both internal control testing and revenue recognition — two of the areas most prone to manipulation.
- Poor supervision. As the engagement partner, Zwick is responsible for reviewing and directing his team's work. The order suggests that oversight of Hoskow's work was, at best, superficial.
- Fabricated documentation. Beyond recycling the predecessor's workpapers, Hoskow reportedly prepared other "significant workpapers" that included information about unrelated issuers — content that had nothing to do with Genie Energy's actual operations.
The sanctions were severe for a firm this size: Zwick CPA's registration was revoked (with a right to reapply after three years), Zwick and the firm were jointly fined $50,000, Zwick was barred from associating with any PCAOB-registered firm (eligible to petition after three years), and Hoskow was barred as well (eligible after two years). Both individuals must complete 40 hours of continuing education on PCAOB auditing standards before they can even ask to come back.
Why This Isn't an Isolated Incident
It's tempting to read this as one bad actor at one small firm. The PCAOB's own inspection data suggests the problem is broader — and it's specifically concentrated at smaller firms.
In its most recent inspection cycle, the PCAOB found that firms it inspects only once every three years (rather than annually) had an aggregate deficiency rate of 61%, and — more strikingly — 96% of firms inspected for the first time had at least one audit with a significant deficiency. Compare that to the largest global network firms, whose combined deficiency rate sits around 26%. Smaller, less-frequently-inspected firms are simply flagged far more often for falling short of the evidence standards an audit opinion is supposed to guarantee.
None of this means small audit firms are inherently untrustworthy — plenty do rigorous, honest work. But it does mean the "Big 4 halo effect" that makes an audited financial statement feel automatically credible doesn't extend evenly across the profession, and a business owner relying on one shouldn't treat the auditor's name on the cover page as the end of the diligence, not the beginning.
Red Flags Worth Knowing, Even If You're Not an Auditor
You don't need an accounting degree to notice when something is off in the way a lender, supplier, or acquisition target presents its audited numbers. A few practical signals:
- A suspiciously clean opinion with zero notes or exceptions. Real audits almost always surface something — a control weakness, a timing issue, an estimate that needed adjusting. An audit that reads as flawlessly perfect, with no management letter comments at all, deserves a second look.
- Reluctance to answer basic questions. If a lender or partner's finance team stonewalls simple questions about who performed the audit, when the firm was last inspected, or what the engagement letter covers, that's worth pressing on.
- A recently changed auditor with no clear explanation. Auditor turnover happens for legitimate reasons, but a same-year swap right before a loan closing or an acquisition is worth asking about directly.
- An auditor you can't find in the PCAOB's public registration and inspection database. For any company whose audited financials matter to a real decision you're making — extending credit, signing a long-term supply contract, buying a business — a quick search of the PCAOB's firm inspection reports takes minutes and can surface a firm's inspection history, or the absence of one.
The Broader Lesson: Your Own Books Are the One Audit Trail You Fully Control
The Zwick case is a reminder that an audit opinion is only as good as the evidence behind it — and evidence can be faked, borrowed, or skipped by people under pressure to move fast. As a small-business owner, you can't control whether a lender's underwriting relies on someone else's shoddy audit. But you have complete control over the integrity of your own financial records, and that matters more than most owners realize: clean, well-documented books are what let you pass diligence quickly when you're the one seeking a loan, an investor, or a buyer, rather than scrambling to reconstruct a defensible paper trail after the fact.
That's also why more finance-savvy business owners are moving toward plain-text accounting systems, where every transaction lives in a version-controlled, human-readable ledger rather than buried inside a black-box database. If a lender, accountant, or auditor ever needs to trace a number back to its source, the entire history is right there — no reconstructed workpapers, no "trust me," no room for the kind of shortcuts that got Zwick CPA barred.
Simplify Your Financial Management
Whether you're the one being audited or you're relying on someone else's numbers, transparent, auditable records reduce risk on both sides of a deal. Beancount.io offers plain-text accounting that's transparent, version-controlled, and AI-ready — every entry is traceable, nothing is hidden behind a black box, and there's no vendor lock-in. Get started for free and see why developers and finance professionals are switching to plain-text accounting. Explore the docs to see how it works, or check out Fava for a visual dashboard on top of your ledger.