Audit watchdog sharpens its fangs
Irba is legally mandated to ensure that the public can trust audit opinions
While the Independent Regulatory Board for Auditors (Irba) is busy with its investigation of the major auditing firm KPMG, it can’t say much.
But the thoughtfully spoken Irba chief executive, Bernard Agulhas, said, whatever the regulatory body does, protecting the public is of the utmost importance. It is mandated by law to do so.
Irba is not a professional body, like the South African Institute of Chartered Accountants, but a statutory one, as required by the Auditing Profession Act, and is tasked with protecting the public.
“We are there to support auditors but, essentially, we are there to protect the public,” Agulhas said.
The body launched its investigation of KPMG’s audits of Guptalinked accounts following media reports, based on leaked emails, suggested the firm’s auditors had failed to pick up what appears to be money laundering.
The KPMG chief executive at the time also attended a Gupta wedding and even emailed one of the brothers to request advice on how to deal with the media.
About 4 500 auditors are registered with Irba, which they are required to do by law, and the regulator has oversight of them.
“The reason that auditors are regulated but not all chartered accountants are regulated is because auditors serve a public interest function,” Agulhas said.
Members of the public and investors rely on the work of auditors and take important (often investment) decisions based on their work. So “it’s important to build confidence in the work of auditors … and that someone is keeping an eye on them”, Agulhas said.
Irba is responsible for setting auditing standards and regulating adherence to them. It sets the competence requirements for auditors that wish to register with the body. These are in line with global standards, as determined by international committees, on which Irba is represented.
A notable feather in Irba’s cap is that, for seven consecutive years, South Africa has been ranked first in the world for the strength of its auditing and reporting standards, according to the World Economic Forum’s Global Competitiveness report.
Of particular concern to Irba is the independence of auditors from their clients.
“The whole KPMG, Linkway issue was just evidence of the concerns that we had [about independence],” Agulhas said.
“In our code of ethics, independence doesn’t just refer to real independence, it also refers to perceived independence … It doesn’t matter whether going to a wedding affected the independence of KPMG; the public thinks that it affected the independence.
“We are not saying that KPMG wasn’t independent, but the perception is they weren’t independent, and when there is a perception of a lack of independence then, unfortunately, the opinions of those auditors cannot be trusted.”
One way to address the issue is the mandatory rotation of auditors, which was proposed by Irba and passed into law.
It requires companies to rotate their auditing firms every 10 years. It becomes effective from 2023. Some companies have had the same auditors for more than 100 years and this raises a question about independence, Agulhas said.
Irba has about 90 employees, although its various departments are supported by independent committees, which make recommendations to the board. The board can consist of up to 10 members and is appointed by the minister of finance.
The largest department in Irba is its inspections department, which checks auditors for compliance.
Irba used to inspect all registered auditors over a three-year cycle but now, with 4500 registered auditors and just 15 inspectors, its check-ups have become more risk-based. This means inspectors prioritise those who audit public interest entities, such as listed companies, pension funds or medical aid schemes, and often inspect them each year.
“The reason we had to go riskbased is because we have limited capacity,” Agulhas said. “That is how we manage our scarce resources.”
The investigations department can receive referrals to investigate an auditor that has failed an inspection by Irba. It can also investigate if it receives a complaint from a member of the public. Otherwise, it can launch its own investigation, as is the case with KPMG.
At any time, the regulator will have between 80 and 100 investigations under way, Agulhas said.
Often an auditor will admit guilt during an investigation, Agulhas said. If not, the legal department may see the matter through to a disciplinary hearing. “It’s actually worse than a high court case; it is really not child’s play,” said Agulhas, adding that the logistics can sometimes take years and can cost a lot of money.
But in high-profile cases,Irba may push for the matter to be heard urgently.
“We don’t want to say we can’t get to everything due to a lack of capacity. We just have to make sure we have capacity. If a high-profile public case comes up, we may have to go to treasury and ask for additional money,” he said. “Treasury is ultimately our shareholder and they must support us.”
The harshest sanction Irba can impose is a R200 000 fine on either a firm or an individual. “It’s not enough,” Agulhas admitted.
Irba has fined auditors involved in high-profile cases such as the failed Sharemax investment scheme and the Fidentia and Leisurenet fraud cases. More recently, it has investigated the audits of the failed African Bank.
“We are busy changing our Act now to make reference to another piece of legislation out of our Act so that our board can decide. If they want to fine an auditor R20-million then they can do that.”
Research also suggests that naming and shaming guilty parties could be an effective penalty and deterrent, but the Act requires Irba to keep the names confidential most of the time. The body is considering a change to the Act that will allow it to identify publicly those found to have flouted auditing standards.
It is also important for Irba to be independent from those it regulates, and it is making sure its board does not include practising auditors. The various committees, unless the Act requires it, are made up of independent individuals, who are unlikely to influence any outcomes.
It is also working on a new funding model to derive resources from independent sources and not from the auditing industry.
One third of its funding, about R100-million a year, comes from the government. Another third comes from auditor registration fees, and the balance comes from the inspections department, which charges a levy for the work it performs on auditors.
“We are there to support auditors but, essentially, we are there to protect the public”