Mauro Botta on PwC, PCAOB Inspections and the Audit File Problem
The auditor who blew the whistle on PwC discusses audit independence, internal controls, whistleblower risk, and whether regulators can see beyond the workpapers
Mauro Botta speaks to Claudine Cassar about what an audit file may fail to reveal, the pressure surrounding material-weakness findings, and what PCAOB inspectors can realistically discover from the workpapers.
Key Takeaways
Mauro Botta is a former PwC senior manager who spent nearly eighteen years with the firm, working on public-company audits in Italy and Silicon Valley. In 2016, he filed a confidential complaint with the SEC raising concerns about audit independence, internal controls and the treatment of professional disagreement. PwC later terminated his employment, and his subsequent retaliation case concluded with judgment for the firm in 2021.
Background to Botta’s whistleblower case is included at the end of the interview.
1. The audit file problem
In 2020 you were interviewed by Jane Turner for Whistleblower Network News. You were quoted as saying:
If the auditors are not doing documentation that reflects the reality, and if the only thing the Government can do when they inspect an auditor is read the documents, then the only way to discover false documents is to change the procedure.
Quite simply, the Government Inspector looks at what the auditors do, and if the auditors write that they did all the procedures, and these are the results, the PCAOB has no way to know if that is true or not.
This is a very strong statement, casting serious doubt on the efficacy of audit inspections. Could you explain how an audit file can look technically complete, while not giving a concrete picture of the findings and work conducted by the auditors?
My experience primarily concerned internal control over financial reporting. If the auditor is the first to identify an error that the company’s controls should have prevented or detected, that raises a control question. The external auditor should not be functioning as one of the company’s internal controls.
If the audit team found the error, the audit file should accurately record that fact. In my experience, however, the documentation of who actually found an adjustment could become a negotiation with management.
CFOs and controllers could exert considerable pressure on the audit team and the engagement partner not to document an issue as auditor-found, particularly where doing so could contribute to a conclusion that there was a significant deficiency or material weakness. Such a finding could have consequences for management, including potentially affecting compensation.
The engagement partner could also face pressure because management’s dissatisfaction might put the client relationship at risk.
So the documentation of who found the adjustment becomes important. If the file says management identified the error through its own controls, that presents a very different picture from one in which the auditor found an error that management’s controls had failed to detect.
An inspector looking only at the final file may therefore see that management identified and corrected the adjustment, without seeing that there had been disagreement over who actually found it.
2. What PCAOB inspectors can and cannot see
Workpaper review is central to PCAOB inspections, alongside the Board’s other inspection procedures. In your experience, what kinds of audit-quality problems are most likely to be invisible if inspectors are mainly reviewing the audit file, and how can these gaps be filled?
One thing the file itself may not reveal is who actually produced the work. If the file contains a complex memorandum attributed to the CFO or controller, the inspector may assume that person wrote it. In my experience, however, there are cases where the audit team may have written the analysis to plug a hole in their findings, and the document is then presented as having been written by the CFO.
So inspectors should not go on the paperwork alone. In cases where there are complex memoranda they should ask the author to walk them through the transaction and explain the analysis. If that person is the author, it should be easy to do. The point is not to ask someone to admit a mistake; it is to assess whether the person has the competence and knowledge that the file says they exercised.
3. Professional skepticism in theory and in practice
I have reviewed your performance feedback from your days at PwC. It included very high praise: “strong set of values, high integrity, trustworthy, ability to call a spade a spade,” and “very strong professional skepticism.”
But then, a reviewer said:
Until he gets the clients pounding the table for him, I don’t think he’ll ever make partner.
Is that contradiction common in Big Four audit, that professional skepticism is praised in principle but becomes a problem when it threatens the client relationship or the partner’s preferred outcome?
Yes. The performance document was eye-opening to me. Seeing statements about the importance of pleasing management in black and white validated my misgivings about the situation.
As I already said, partners want to retain the engagement. So professional skepticism is all well and good in principle, but in practice it can rapidly become a problem.
4. The cost of being “too black and white”
One of the phrases that appears in your feedback is that you could be “too black and white.” Another is that you needed to “choose your battles.”
Where is the line between being appropriately pragmatic and becoming too willing to compromise?
I think phrases such as “choose your battles” and “see the shades of grey” can become excuses. If you are an ethical person, you do not need those artificial exercises.
Obviously, even in accounting there can be different ways of seeing things. But especially in internal controls, it is much more black and white. After receiving those performance appraisal notes, I discussed the matter with the people giving me that criticism, but they had very little to show that my position was not warranted, except for not irritating management.
5. Internal controls, material weaknesses and aggregation risk
A key issue in your case was whether repeated internal-control problems should be treated as isolated issues or aggregated into a broader material weakness.
You argued that a series of control issues, taken together, revealed something deeper about management competence and the control environment. PwC and National Office disagreed with your conclusion.
In practice, how much discretion do audit teams have when deciding whether a pattern of issues rises to the level of a material weakness? Is aggregation one of the places where audit judgment is most vulnerable to commercial pressure?
When an auditor identifies a control issue, the first thing to understand is the root cause. Was the control designed poorly? Was the design appropriate but the execution poor? Was the person performing or reviewing it lacking the necessary competence?
If several controls are not working and the same underlying cause is involved, you have to consider whether those deficiencies should be evaluated together. That is one form of aggregation. A lack of competence may manifest itself across several controls, and the combined effect may result in a material weakness.
I was a senior manager at PwC, and it was my job to identify these weaknesses, but of course, the engagement partner and the quality review partner could overrule me. My only option was to document the disagreement in the working papers, but as I have already explained, there was serious pressure to avoid doing so. It was made amply clear to me that reporting such disagreements would be very detrimental to my career.
On Cavium, National Office ultimately sided with the partners. At the time, I accepted the conclusion because I assumed National Office had heard both sides. I found out during the trial that I had been excluded from important discussions and that answers had been given that I would have challenged. It was not a debate. I was siloed out of the process.
6. When the auditor starts helping the company
One of the most striking issues in the materials you provided concerns the line between auditing management’s work and helping management create that work. In your SEC complaint outline, you described situations where you believed the audit team was helping companies draft or correct technical accounting documentation rather than independently auditing it.
Where is the line between permissible assistance and impairing independence?
There are guidelines and examples of what an auditor clearly cannot do. The large firms also have independence offices, and when an area is genuinely unclear, a senior manager or partner can consult them.
But if the audit team writes the accounting analysis that management is supposed to own, the auditor is doing the accounting that it will later audit. In my experience, this happens regularly.
7. Client service versus client appeasement
Big Four firms often present themselves as trusted advisers. That may make sense in consulting, tax, or advisory work. But audit is different because the auditor’s duty is ultimately to investors and the public. The company pays the fee, while the public relies on the opinion.
Can an auditor be both a trusted adviser to management and an independent public watchdog? Where does good client service become client appeasement?
The most important word in that question is “client.” Who is the client? The problem is that the Big Four see management as the client, when the client should be the shareholders. Once people are taught that management is the client, they think of management as somebody the firm depends on and needs to keep happy. The problem starts there.
What is client appeasement? It is management appeasement.
What is good client service? If the clients are the shareholders, good service is doing a proper audit.
But giving good service to shareholders often conflicts with appeasing management, and that is the core issue.
I made that point internally every time. I did not call management the client; I called it the company. It may seem like one word, but it is much more than one word. It is what the word implies and what people make of it.
8. The career risk of reporting weak controls
Academic research has found that audit firms and individual partners may face market and career consequences after issuing adverse internal-control opinions.
Did that match what you saw in practice? If reporting a material weakness can upset the company, affect the partner relationship, and damage the economics of the engagement, can it become career-damaging for the individual auditor who insists on raising the issue?
Absolutely. I saw partners removed from accounts and then receive fewer shares. Their prestige was affected. The firms say, “PwC is too big—who cares if we lose one account?” That may be true for the firm, but the individual partner cares. That is where the problem lies.
The pressure on the partner is real, and it permeates through the team. Losing an account can have implications for the partner’s career, so finding an issue that management does not want to be exposed becomes a relationship problem for the partner.
I understand the pressure, but I do not have a great deal of empathy for partners who decide not to do the job properly. If you are unable to do the job as you are supposed to do it, you should get out. You cannot say it is too difficult and then ask for mercy—not when people rely on your work.
Editor’s note: A 2025 Journal of Accounting Research study found that partners who issued adverse internal-control opinions experienced unfavorable changes in their client portfolios, with effects persisting for at least three years. The finding is consistent with Botta’s distinction between the impact on a large firm and the impact on the individual partner.
9. The Harmonic audit and “simply doing an audit”
In the Harvard Business School case, you described the Harmonic audit as one where the team was not doing a “tough audit,” but “simply doing an audit.” The same section describes your concern that the work was late, the deadline was tight, and the company was frustrated.
What does that phrase mean to you, “simply doing an audit”?
On Harmonic, my professional view was that a proper audit had not been done the year before. In several areas, audit procedures recalculated management's estimates using management's own methodology, without challenging the assumptions beneath it.
When I began asking questions, management was upset because PwC had not asked those questions before. They complained and asked for my removal. The engagement partner told management that the company was going through a “tough audit,” almost as if he were excusing the team’s behavior.
I stopped him and said, “This is not a tough audit. It is simply an audit.” The power of that word matters. Calling it a tough audit makes it appear that the team is doing something unusual, when the team is simply doing its job.
10. Deadlines and filing pressure
Public-company audits often happen under intense deadline pressure. Companies want to release earnings and file on time. Audit firms do not want to be blamed for delays.
How does deadline pressure affect audit quality, especially when new issues emerge late in the process?
A deadline does not change the evidence required to support an audit opinion. If the work is not complete, the company should file a Form 12b-25 notification of late filing. For a Form 10-K, the rule provides a fifteen-calendar-day extension if its conditions are met. If the audit still cannot be completed, the filing should be late. The honest answer cannot be to sign before the work is done.
In practice, I experienced partners berating their own staff because errors were found close to the deadline. Finding such issues becomes a problem because the partner then has to deal with an unhappy controller or CFO asking why they were found so late.
The greatest pressure often comes before the earnings release, even though it is unaudited. Once it is issued, management’s credibility is at stake. Any error found between the earnings release and the Form 10-K becomes a major relationship problem, and the team comes under pressure to conclude the audit before the work is ready.
11. QC 1000 and firm-wide quality control
QC 1000, the PCAOB’s new quality-control standard, is scheduled to take effect on December 15, 2026. It is designed to move firms towards a more systematic, risk-based approach to quality control. The PCAOB has also proposed targeted amendments to parts of the framework.
Does QC 1000 address the problem you have been describing, or does it still depend too heavily on what the firm itself documents?
It is too soon to tell what the impact of QC 1000 will be. Frankly, I do not expect much from it because I do not believe it addresses the core problem: a profession built around a conflict of interest and regulatory agencies that, in my view, are unwilling to do what is necessary with the Big Four.
It may have good intentions, but I do not believe it addresses the root cause. To me, it risks becoming just another paper exercise.
12. Seeing beyond the file
If you were redesigning PCAOB inspections, what would you change?
I would conduct interviews to assess management’s competence. Ask the CFO or controller to walk through a complex transaction and explain the accounting analysis. It will become clear very fast if it was in fact management who wrote certain documents.
I would also make inspections much less predictable. The PCAOB focuses heavily on internal-control documentation and the high-risk areas. It should look more at actual accounting and at areas treated as low risk, where the review may stop at senior-manager level. If you want to identify failures, start there and be much more unpredictable about what you inspect.
Editor’s note: The PCAOB states that, as part of its inspection process, it reaches out to nearly all audit committee chairs of U.S. issuers whose audits it inspects and invites them to speak with inspectors.
13. The revolving door
Some senior regulatory and audit-oversight positions have been held by people with extensive Big Four experience. Supporters argue that these roles require deep technical expertise. Critics see a risk to public confidence when people who regulate, oversee or set standards affecting the profession have spent much of their careers inside major audit firms.
How do you see that balance?
I think the revolving door creates a serious appearance problem. There should be a meaningful cooling-off period in both directions. If you leave the PCAOB or another senior regulatory role, you should not be able to join or rejoin a public accounting firm for at least five years.
The same concern can arise when retired partners join boards and audit committees while retaining financial or close professional ties to their former firms. In my experience, companies also ask auditors informally for recommendations about whom to hire. Even where no rule is broken, those continuing relationships can create an independence concern in appearance.
14. Whistleblower protection and regulatory transparency
SOX and Dodd-Frank provide whistleblower protections, but your case shows how difficult retaliation claims can be to prove. In practice, how much protection does a whistleblower inside an audit firm have?
In practical terms, none. There are laws that are supposed to protect whistleblowers, but in my case the SEC did not protect me. I believe its investigation exposed me to PwC as the person who had raised the concerns.
The central problem is proving retaliation. The firm says it did not know you were the whistleblower, and how can you prove that is not true? Also, the whistleblower is fighting an organization with far greater legal resources. In my case, I had lawyers working on a contingent fee and was facing a legal team of around fifteen attorneys. What are the odds that the whistleblower will prevail?
I have spent about eight years trying to obtain the SEC’s records under the Freedom of Information Act. The process has involved long delays, heavily redacted productions and, in my view, very little explanation. Some partially redacted documents may contain evidence relevant to what PwC knew, but I cannot assess that until the SEC produces the records. As a whistleblower, you need to be able to withstand a great deal of pain and suffering.
Editor’s note: The 2021 court credited testimony from PwC’s outside counsel that the SEC did not disclose that it had received a whistleblower complaint or identify Botta. The court also found that the PwC executive who made the decision to terminate him did not know that Botta was the whistleblower. Botta disputes important factual findings in the judgment and argues that withheld SEC records may shed further light on what PwC knew.
15. Reform and final reflections
What reforms do you think are required to resolve the problems we have discussed?
Having a regulator assign audits could be a solution, although it creates difficult questions about how the work is allocated among firms and how competition and quality would be measured. My preferred model is closer to the tax authority: a public body should perform the audit rather than the current system, in which the issuer’s audit committee appoints and oversees the auditor while the issuer pays the fee.
The other fundamental change is that the auditors should come in after the financial statements have been filed. The tax authority is not present while you prepare your tax return, helping you to produce it. If auditors arrive after filing, any misstatement they identify would have to be evaluated as an error in financial statements already on the public record.
The system does not make it easy to be ethical, but that does not excuse the individual auditor. If a partner is unable to do the job properly, the partner should resign. People rely on this work. For me, continuing to raise these issues is not much of a choice. It is the right thing to do, and I intend to keep doing it.
Background to Mauro Botta’s whistleblower case
Mauro Botta is a former PwC auditor and audit-industry whistleblower. He started his career in the PwC Milan office in 1999, and transferred to San Jose in 2004, just as U.S. audit firms expanded their public-company internal-control work following the Sarbanes-Oxley Act.
The concerns that ultimately led Botta to the SEC arose largely from his work on two clients: Cavium and Harmonic.
At Cavium, he identified a series of accounting adjustments and internal-control problems over several reporting periods. By 2014, he concluded that the recurring issues should be considered together and that, in his view, they supported a material-weakness finding relating to the competence of the finance function. The engagement partner disagreed, and PwC’s National Office ultimately concluded that the issues did not establish a material weakness.
In the case of Harmonic, Botta describes audit procedures that recalculated management's estimates using management's own methodology without challenging the assumptions beneath it. When he increased the level of scrutiny, management complained that the auditors had not asked those questions before. The engagement partner referred to the work as a “tough audit.” Botta’s response, which became central to his account, was that the team was simply doing an audit.
In late 2016, Botta submitted a confidential complaint to the SEC. The complaint alleged that PwC had prioritized client satisfaction and commercial considerations over auditor independence and rigorous internal-control reporting. In April 2017, the SEC notified PwC that it had opened an investigation into the firm’s 2013 and 2014 Cavium audits. PwC terminated Botta on August 17, 2017, while that investigation was still underway.
The SEC investigated but did not bring a public enforcement action against PwC based on Botta’s allegations. In July 2021, after a bench trial, the U.S. District Court for the Northern District of California entered judgment for PwC on Botta’s retaliation claims. Botta continues to dispute important factual findings and the fairness of the process.
Editor’s Note: Botta’s allegations were contested. PwC denied that it retaliated against him, the SEC brought no public enforcement action based on his complaint, and the 2021 court entered judgment for PwC. Unless otherwise stated, the answers reflect Botta’s account.
This article is part of the Big4News Expert Voices Series
Expert Voices
Expert Voices features interviews and guest contributions from former insiders, whistleblowers, academics, regulators and experienced practitioners. The series examines the structures, incentives and professional cultures behind events at Deloitte, PwC, EY and KPMG.
About Claudine Cassar
I’m a corporate anthropologist and former Deloitte equity partner. I sold my technology business to Deloitte in 2016 and led the Malta Consulting team for five years. I am the founder and editor of Big4News, which provides independent, clear analysis of PwC, Deloitte, EY, and KPMG — free from corporate spin.
Find me on LinkedIn, X, Instagram, or my author website.
Feel free to reply to this newsletter — I read every reply.
An interesting read, very à-propos