Maybe, maybe not. The other major area is disclosure. Even if you have all the controls in place oto produce the information you report you still need to decide what gets reported. Disclosing the facts relevant to the needs of the user is sometimes subjective.
I am ignorant of the facts of this situation but based on experience its possible the issue was what was disclosed and whether it needed to be. This is again an area that the auditor uses his professional opinion to decide.
Costly lawyering, muddying or destroying the paper trail, and sheer stupidity, may get the perps off, but that'll just make 'em the OJs of corporate finance.