# Who regulates the professionals: mapping the alphabet soup of oversight
A mid-size advisory firm, call it Meridian & Co., audits a mid-cap manufacturer, advises the same manufacturer's board on a restructuring, and helps its general counsel with a cross-border joint venture. Three engagements, one client, and at least four regulators with an opinion on how each piece of work must be done. This is normal in professional services, and it is exactly where firms get into trouble.
This lesson maps who regulates what, where jurisdictions collide, and how due diligence teams actually check a firm's regulatory footprint before a deal, a partnership, or an audit sign-off.
SEC (Securities and Exchange Commission): the US federal regulator of securities markets. It oversees public company disclosure, and by extension, the audits that support those disclosures. It does not license accountants directly but can bar individuals from practicing before it.
PCAOB (Public Company Accounting Oversight Board): created by the Sarbanes-Oxley Act of 2002 after the Enron and Arthur Andersen collapses. It inspects and disciplines audit firms that audit US public companies, sets US auditing standards, and registers every firm, including non-US ones, that audits a company listed on a US exchange. PCAOB inspection reports are public and are a first-stop due diligence resource.
State bars: in the US, the practice of law is licensed and disciplined state by state (for example the State Bar of California, the New York State Bar). There is no federal license to practice law. A lawyer barred in New York generally cannot give New York legal advice from an unlicensed jurisdiction without a specific exemption.
FCA (Financial Conduct Authority): the UK's conduct regulator for financial services firms, covering investment advice, asset management, and consumer credit, among others. It is the rough UK analogue to parts of the SEC's mandate, though structured differently.
AICPA (American Institute of CPAs): the main US professional body for accountants; it sets ethics standards and administers the CPACPACost Per Acquisition: the total cost to generate one customer or conversion, computed by dividing total spend by the number of acquisitions.View full definition → exam, but state boards of accountancy issue the actual license.
State insurance and professional licensing boards, the FRC (Financial Reporting Council) in the UK, and ESMA (European Securities and Markets Authority) at the EU level round out the picture depending on geography and service line.
Audit line: Meridian audits the manufacturer's financial statements. Because the client is US-listed, the PCAOB governs the audit methodology, working paper retention, and partner rotation rules. The SEC governs auditor independence rules (a big one: an audit firm generally cannot also provide certain non-audit services, like bookkeeping or actuarial services, to the same audit client). If Meridian has a European affiliate auditing the same group's EU subsidiary, that affiliate answers to its national audit regulator, often coordinated under EU statutory audit rules and, since Brexit, separately under the UK's FRC.
Legal line: Meridian's law arm advises the board on restructuring. Whichever state bar licenses the advising lawyers governs conduct, confidentiality, and conflicts rules. If the same lawyers touch securities disclosure language, the SEC's rules on attorney conduct (adopted under Sarbanes-Oxley Section 307) also apply, requiring "up the ladder" reporting of material violations.
Consulting line: the joint venture advisory work is largely unregulated as a profession, but if it strays into investment advice (recommending specific securities or deal structures for compensation tied to a transaction), it can trigger SEC broker-dealer registration questions, or FCA authorization requirements if the work touches UK clients.
Three friction points recur in real firms.
1. Independence rules collide across lines of business. SEC and PCAOB independence rules restrict an audit firm from doing consulting work for its own audit clients. Meridian's consulting arm cannot help run the same manufacturer's restructuring while its audit arm certifies that manufacturer's books, at least not without careful walls and disclosure. This is the direct legacy of the Arthur Andersen and Enron failure: Andersen's consulting relationship with Enron was widely seen as compromising audit independence.
2. Multi-state and multi-country licensing creates gaps. A lawyer licensed in New York advising on a UK subsidiary's employment law is practicing in an area they are not licensed for. Firms manage this through local counsel networks and referral arrangements, but due diligence teams should confirm that "global" legal advice is actually being delivered by locally licensed professionals, not just a partner with a global-sounding title.
3. Cross-border audit oversight is negotiated, not automatic. The PCAOB inspects non-US audit firms that sign off on US-listed companies, but historically some jurisdictions, notably mainland China, blocked PCAOB inspectors from full access. This came to a head in 2021 to 2022 under the Holding Foreign Companies Accountable Act, which threatened to delist companies whose auditors the PCAOB could not inspect. A 2022 agreement restored some access; the situation is monitored on an ongoing basis, and specifics should be checked against current PCAOB statements since they evolve.
Before investing in, partnering with, or acquiring a professional services firm, check:
1. PCAOB inspection history: pull the firm's most recent inspection report. Repeated Part I findings (audit deficiencies) are a red flag.
2. State bar and licensing verification: confirm the specific individuals doing the work hold active, unrestricted licenses in the relevant jurisdiction, not just that "the firm" is a law firm.
3. Independence policy documentation: ask for the firm's client conflict-check and independence-clearance process, especially where audit and advisory lines share a client.
4. Regulatory action history: search the SEC's litigation releases and enforcement database, and equivalent FCA or state bar disciplinary registries, for prior actions against the firm or its named partners.
5. Revenue mix by regulated activity: understand what proportion of fees comes from PCAOB-governed audit work versus unregulated consulting; this changes the risk and disclosure profile materially.
Knowledge check
1. Why does a single advisory firm like Meridian & Co. face oversight from multiple regulators when serving one client across audit, restructuring advice, and cross-border joint venture work?
2. What was the primary reason the PCAOB was created rather than leaving audit oversight solely to the SEC?
3. A lawyer licensed only in New York wants to advise a client on matters governed by California law from a California office. What does the state-by-state bar licensing structure imply about this scenario?
4. Select ALL correct answers about the SEC's role in relation to audit firms.
Select all the correct answers.
5. Select ALL correct answers about why 'mapping a firm's regulatory footprint' matters during due diligence on a professional services firm.
Select all the correct answers.
Say Meridian's audit fee from the manufacturer is $2 million a year, and its consulting arm is offered a $500,000 restructuring advisory contract from the same client.
🎬 [VIDEO: "How Sarbanes-Oxley Changed Auditing Forever" - youtube.com/results?search_query=sarbanes+oxley+pcaob+explained - search for a current explainer covering the Enron/Andersen collapse, the creation of the PCAOB, and post-SOX audit independence rules]