Bernie Madoff's strip-mall auditor: how the biggest Ponzi scheme passed its audits, and what a KYB review would have checked

Bernard L. Madoff Investment Securities reported returns so steady that investors treated them as a law of nature. Every year a certified audit report said the books were sound. The audit came from a one-accountant firm in a small suburban plaza, 30 miles north of Manhattan. This page tells the case from the court and regulatory record, reproduces the narration of our short film, and sets out the checks a business-verification analyst would run on a firm like his today.

What really happened

Bernard Madoff was a former chairman of the board of directors of the NASDAQ stock market and the sole owner of Bernard L. Madoff Investment Securities LLC (BMIS), according to the SEC. Alongside a legitimate market-making business, BMIS ran an investment advisory operation. In its Form ADV filed in January 2008, BMIS told the SEC it had over $17 billion in assets under management.

The returns were the selling point. The SEC's Inspector General later found that between June 1992 and December 2008 the agency received six substantive complaints raising significant red flags, and that two articles in reputable publications in 2001 had questioned Madoff's "unusually consistent returns." A May 2003 complaint from a hedge fund manager, who had done due diligence on two Madoff feeder funds, listed the problems: the strategy could not be duplicated by anyone else, returns showed no correlation to equity markets over more than ten years, accounts were typically in cash at month end, Madoff charged no normal performance fees, and "the auditor of the firm was a related party to the principal."

The auditor was Friehling & Horowitz, CPAs, P.C., of New City, New York. The SEC's complaint says David Friehling was the firm's only CPA and its sole shareholder, and that from 1991 through 2008 the firm certified BMIS's annual audited reports filed with the SEC. Friehling and his family had held accounts at BMIS since about 1980 and had withdrawn more than $5.5 million since 2000. The Associated Press described the office as a tiny storefront "next door to a pediatrician in a drab suburban building." Fortune reported a 13-by-18-foot office in a small plaza.

According to the SEC, there was no meaningful audit. Friehling never verified that the securities existed. BMIS, not the auditor, chose which customers received confirmation forms. The only physical count was of the certificates that happened to sit on BMIS's premises. The SEC also alleged that Friehling told the American Institute of Certified Public Accountants for years that he did no audit work, which kept him out of peer review.

On December 10, 2008, Madoff told two senior employees at his Manhattan apartment that the advisory business was "all just one big lie" and "basically, a giant Ponzi scheme," with losses he estimated at about $50 billion (SEC complaint). The New York Times reported that the two executives were his sons, Mark and Andrew, who notified the authorities. The SEC sued Madoff and BMIS the next day, December 11, 2008.

On March 12, 2009, Madoff pleaded guilty to an eleven-count information that included securities fraud, investment adviser fraud, mail and wire fraud, money laundering, and false filings with the SEC. On June 29, 2009, Judge Denny Chin sentenced him to 150 years in prison and ordered a forfeiture of $170.799 billion. Friehling pleaded guilty on November 3, 2009, to securities fraud, investment adviser fraud, four counts of filing false audit reports and three tax counts, and agreed to cooperate and forfeit $3,183,000.

A note on the film's numbers. "Fifty billion dollars" is Madoff's own estimate at the time he confessed, and it includes profits that existed only on customer statements. What is actually recoverable is a smaller, different figure: the court-appointed SIPA trustee reports about $15.494 billion recovered or agreed to be recovered as of September 29, 2026. The film says charities, banks and movie stars invested; this page does not rely on that line, because we did not check it against a primary source.

The film

A 43-second claymation dramatization from the Sweat AI Fraud Files series. The characters and scenes are illustrations; the facts are summarized above with sources.

Narration transcript

For decades, his clients almost never lost money.

Not in crashes. Not in recessions. Every month: up.

His name was Bernie Madoff. He had even run the Nasdaq.

Charities, banks, and movie stars handed him billions.

So who checked his books?

One accountant. In a tiny office, in a strip mall, next to a children's doctor.

In 2008, the money ran out. He told his sons: it's all one big lie.

Fifty billion dollars. Gone.

He got a hundred and fifty years.

Today, the statement still looks perfect. So does the audit letter.

Sweat AI checks who's behind them.

Check who checked.

How KYB would have caught it

Imagine BMIS as a counterparty today: a fund administrator onboarding it as an investment manager, a bank opening an account for a feeder fund that invests with it, or a platform reviewing its statements as proof of assets. Each check uses evidence that existed before 2008.

Related terms

• Enhanced due diligence: what a counterparty with this profile should have triggered.
• Control person and ultimate beneficial owner: who runs the firm and who can move the money.
• Request for information (RFI): how an analyst asks where assets are held and how returns are earned.
• Evidence packet: recording what was checked against sources the applicant does not control.
• The earlier case in the series: Charles Ponzi, whose name the scheme still carries.

Check who checked

Madoff's customers had statements, and the SEC had audited annual reports. Both came from inside the fraud: the manager produced the statements, and an auditor with a stake in the firm signed the reports. Nobody on the outside confirmed the assets with a party Madoff did not control. That is the core of counterparty due diligence. An audit letter is evidence about the auditor as much as about the client, so the analyst checks who signed it, how big they are, and what ties them to the principal.

Sweat AI is an AI-native BPO for banks and fintechs, starting with back-office workflows like KYB, onboarding and fraud reviews. Our analysts work those queues around the clock and prepare each review with its evidence and a recommendation; your team makes the final decision. If a counterparty in your queue hands you perfect statements and an audit letter from a firm you have never heard of, see how a business investigation or a KYB review from Sweat AI would handle it.