Read the DOJ filing, linked in a comment below. The auditor physically sent a person on site whose job was to watch the financial people log into the banks web interface, verify the balance, and print bank statements for the last 12 months, all in front of the auditor. The passage doesn’t make it clear why the auditor didn’t watch the ceo pull the records for the accounts receivables account
Update: filing Is here: https://www.justice.gov/usao-sdny/press-release/file/1317641...
Relevant Passage:
“As part of its due diligence process, the Audit Firm had an employee (the “Auditor”) conduct a physical site visit at NS8’s offices in Las Vegas, Nevada. The Auditor was directed by a more senior Audit Firm employee to have someone from NS8 log in to the online portal for each NS8 bank account, display the current account balance, and download monthly bank statements for fiscal year 2019.”
“Based on my interview with a member of the NS8 finance department (“Finance Employee-1”), I have learned, among other things, that on or about March 11, 2020, Finance Employee-1 and ROGAS met with the Auditor in ROGAS’s office. The purpose of that meeting was for ROGAS and Finance Employee-1 each to log into the online portals for the bank accounts to which they had access (for ROGAS, the Revenue Bank Account) and download monthly account statements for the Auditor. During that meeting, Finance Employee- 1 logged into the online portal for the Expense Bank Account -- to which Finance Employee-1 had access -- and downloaded monthly account statements. Finance Employee-1 understood that ROGAS was doing the same for the Revenue Bank Account during the meeting”