The fact that BofA brought in Booz instead of a forensic auditing firm indicates one of two things:

1) they pretty much know what is apt to be leaked, see this as a PR issue (because they don’t see any laws as having been broken) and want to have a 3rd party that can verify and concur, or

2) know that they have broken many laws but don’t know what, if anything, wikileaks has and opted for a plausible auditor (and Booz ain’t an auditor) with the intent of obfuscating and hoping folks buy it (or that Wikileaks has the goods on someone else).

White collar criminals are very much of the “act as if” mold since that is how they got in the position where they could commit crimes - by getting people to trust them as being competent. Industry is dominated by the incompetent who can be easily buffaloed by smart sociopaths. All the same, that doesn’t mean someone acting the part is a criminal - odds are they might just be incompetent.