Wheels turn slowly in audit probes
Outcomes of investigations by sector bodies uncertain amid expectation gap
It has been nine months since the Independent Regulatory Board for Auditors (IRBA) announced it had launched an investigation into KPMG’s audits of Linkway Trading, the Gupta company used to channel government funds to the family’s Sun City wedding in 2013.
The regulator’s probe, which also covers KPMG’s report on the so-called rogue unit at South African Revenue Service (SARS), has now widened.
Irba is tight-lipped about its new lines of inquiry, suggesting that some of the information it has uncovered is not yet public.
As the board has about 150 open investigations, including a review of Deloitte’s audit on Steinhoff for 2014, 2015 and 2016, it could take at least eight more months to wrap up the KPMG matter.
Its investigation into Deloitte took almost two years and the disciplinary hearing started more than three and a half years after Deloitte’s client, African Bank, collapsed.
That is why the South African Institute of Chartered Accountants (Saica) commissioned the Ntsebeza Inquiry to investigate whether any of its members employed by KPMG contravened the body’s code of professional conduct.
The inquiry will also examine whether there are any “systemic deficiencies” in KPMG’s risk management systems that led to unprofessional conduct, and whether the company’s internal policies adhere to Saica’s code of conduct.
While Irba is investigating the conduct of KPMG as an entity and the registered auditors implicated, the Ntsebeza Inquiry probes individual chartered accountants’ behaviour.
“We couldn’t wait for [the outcome of] a prolonged [Irba] investigation. We needed a speedy resolution,” Saica CEO Terence Nombembe said in September. Six months on and the Ntsebeza Inquiry has struggled to stick to its far tighter timelines. It has commenced public hearings and hopes to make recommendations to Saica by end-April. Meanwhile, Irba has provided no timelines, saying only that “one of the lines of investigation is nearing completion” and that it will be tabled at the next investigating committee, while others are “progressing satisfactorily”.
Matters investigated by Irba are tabled before its investigating committee, comprising eight nonexecutive members.
The committee can make one of the following recommendations to the disciplinary advisory committee:
Dismissal of the matter due to a lack of evidence of improper conduct, or it being inappropriate to charge in the circumstances due to, for example, the conduct being negligible in nature or consequence;
A settlement through a consent order process, which usually involves a fine; or
Referral of the matter to the disciplinary committee for a hearing (as in the case of the Deloitte/African Bank matter).
The disciplinary advisory committee, a sub-committee of the board consisting of three people, decides which of the options to follow.
In 2017, the committee decided 96 cases, of which two were referred to the disciplinary committee for a full hearing.
Matters dealt with through a consent order are generally subject to a fine of up to R200,000 per charge.
From 2012 to 2017, errant auditors paid the board R11.82m in fines, excluding suspended portions of fines.
Legal costs awards made against auditors and in favour of the board came to an additional R6.3m in this period.
Over the six-year period, nine auditors were removed from the register after a disciplinary hearing or voluntarily before a hearing.
Irba CEO Bernard Agulhas says a disciplinary process must protect the right of the individual to a fair hearing.
“There is no provision in our act for precautionary suspensions. We can only take action when an auditor is proven guilty of improper conduct,” he says.
Proving Deloitte, KPMG or the firms’ auditors guilty of breaching the Audit Profession Act and Irba’s Code of Professional Conduct is not easy.
If KPMG can provide Irba with documentary evidence that supports the audit opinions it reached on Gupta-family companies and SARS, demonstrating that there was no breach of the professional standards or code of conduct, there is very little for which it can be charged. The same applies to Deloitte’s audit of African Bank.
“The sufficiency and appropriateness of audit evidence to support the opinion expressed is a key concept in auditing,” Jillian Bailey, head of Irba’s investigations department, says.
“If there was blatant money laundering and the auditor missed it during a test of noncompliance with laws and regulations, we will raise a finding on this in our investigation. Any non-compliance with the professional standards and code of conduct will result in an investigation finding,” she says.
Leaked e-mails show that Linkway was instrumental in channelling R30m to the Gupta family’s Sun City wedding, money that was intended to go to black dairy farmers in the Free State. Linkway got its hands on the cash through an elaborate money-laundering scheme using shelf companies in Dubai.
When auditors detect noncompliance with laws and regulations, referred to as “reportable irregularities”, they are required to report them to the regulator.
A reportable irregularity is an unlawful act committed by someone in a management position that could cause material financial loss to an entity, is fraudulent, or represents a breach of fiduciary duties.
Irba says KPMG has submitted no reportable irregularities relating to its audits of Guptafamily companies — Oakbay, Sahara and Linkway Trading — dating back to 2006. If KPMG can demonstrate that there was no way it could have picked up on “reportable irregularities” during its Linkway audit, it may well be off the hook.
This will come as a disappointment to those who say that KPMG should be held at least partly responsible for the Guptas’ raiding of state coffers.
Agulhas describes this as the “expectation gap”.
“The public is expecting auditors to pick up on things that auditors might not be expected to pick up on in terms of the standards. In the current environment the expectation gap is growing,”
he says. But Agulhas also feels strongly that auditors are not sufficiently sceptical. Bailey agrees, saying that auditors are expected to be vigilant and sceptical and to apply due care in reaching an opinion on the fair presentation of financials. But, she adds, they are doing no more than just that.
“When an auditor signs off on a company’s financials, they are expressing an opinion on whether the financial statements are a fair reflection of the financial affairs of a company,” says Bailey.
An audit opinion is not an assurance that every single transaction that a company entered into is legitimate, because auditors do not check all transactions.
A R30m project management fee for the wedding, invoiced by Linkway that appears to have done little other work, should arguably have raised red flags. While KPMG has admitted its work for the Guptas and SARS “fell considerably short” of its standards, it has stopped short of admitting to any illegal behaviour, saying an internal probe did not uncover any such evidence.
Perhaps, like McKinsey, whose seemingly forced partnership with Trillian to win work for Eskom was used in 2018 as a Harvard Business School case study, KPMG’s work for the Gupta family will be relegated to a business school course on ethics.