<p>We explore a regulatory setting where both a regulator and a firm can audit to uncover defects and prevent accidents under limited liability. The firm determines whether to audit before or after the regulatory audit or not to audit at all; the regulator may impose a penalty when the regulatory audit uncovers a defect. We demonstrate that penalty size fundamentally shapes the firm’s self-auditing decisions—whether and when to audit. Small penalties crowd out and delay self-auditing, as the firm relies on regulatory oversight, whereas larger penalties incentivize preemptive self-auditing to avoid sanctions. The socially optimal regulatory policy, balancing audit intensity and penalty size, depends on the maximum enforceable penalty. Notably, neither maximum audit intensity nor maximum penalty is necessarily socially optimal.</p>