In this model, shareholders can use auditors' reports to contract with a privately-informed manager. Our imperfect audit technology allows the auditor and the manager to collude. Auditors are useful only if they have good information and if the manager's liability is high. Expected maximum deterrence is not desirable and production is suboptimal, even with unbounded punishments, risk-neutral agents, and costless auditing. Raising the manager's punishment raises the bribe he may offer the auditor, which raises the cost of preventing collusion. We also distinguish internal auditors (who are costless but may collude) from external ones (who are costly but never collude) and show that the optimal contract may specify random external audits.