Indeed, since they are on US SE (NYSE?), they are required to implement internal controls under Sarbanes-Oxley Act and they should be indeed audited by a third-

Indeed, since they are on US SE (NYSE?), they are required to implement internal controls under Sarbanes-Oxley Act and they should be indeed audited by a third-party auditor (E&Y, if i recall correctly), including attestation of the controls. And, to best of my knowledge, the actions described in this article do have to be authorized by the top management of Google or by Head of the respective Department (the Control procedure), since this involves a material amount of expenses and also represents a revenue component. Now, E&Y should do they work and investigate the reason for this 'failure' of controls, as Google states and it wouldn't be bad if the PCAOB will be involved with a review of E&Y.