You're both right and wrong. The auditor has professional ethical and legal obligations. Clearly that is a special case of being particularly culpable.

However, everyone who knew what was happening and the scam being run should probably have been deemed complicit