I don't think that's enough, David Duncan in particular should have gone to jail, but it's not as if there were no consequences and to be fair to the US government they went after AA hard.
> They were indicted for shredding documents. These documents were drafts and other items that do not support the final product. All accounting firms establish policies for routinely shredding such documents.
See - all routine. Sure, your routine might not include being "reminded" to arrange for piles of documents to be urgently shredded once you hear investigators are coming but that's why you might some day be found guilty of crimes, whereas Arthur Anderson were "not guilty" after all the evidence was destroyed and their chums in the US Supreme Court reached in and overturned verdicts against them for destroying the evidence.
Now, one of the nice things in overseeing the Web PKI is that I don't care whether the auditors are incompetent or crooked, it's the same either way to me. I don't expect even their own bosses to do as much as slap them on the wrist for enabling fraud. If I'm relying on audit then I know I might as well toss a coin, I'm always going to be digging deeper than that to understand what was actually going on regardless of whether the auditors "forgot" or deliberately chose not to look.
Remember Arthur Anderson. They're gone, but the US Supreme Court concluded that they weren't guilty! They make O J Simpson look like the picture of innocence, and yet somehow the Supreme Court felt the need to grant certiorari and then decide actually people who do crimes aren't necessarily guilty of those crimes if they're rich old white men...