KPMG scandal spotlights forensic audits
The Independent Regulatory Board for Auditors already has an investigation under way into KPMG’s auditing of the Gupta companies; now it is contemplating stretching its powers to investigate the firm’s forensic report on the South African Revenue Service’s (SARS’s) so-called “rogue unit”.
Board CEO Bernard Agulhas has told Parliament this is justified because a registered auditor signed off the SARS report. But the stretch is an interesting one because an audit and a forensic audit are very different things.
They are conducted by different sets of people, using different processes, in a different market. And until now there has been no clear regulatory framework for forensic investigators, only some of whom are chartered accountants or auditors in companies such as KPMG. When the external auditors conduct an audit they look at only a sample of the company’s transactions, based on an agreed level of “materiality”, using specialised procedures and systems designed to detect any deficiency in the numbers.
By contrast, a forensic investigation would usually seek out and examine all the evidence on “who, what, where and why”. There is no blueprint, says a senior forensics professional at (another) of the big four firms, and no two investigations are the same.
There are standards to ensure the findings are supported by the evidence, and are independent and objective, and the same kind of rigour is expected as would be the case with an audit. But the real quality test, says the forensics professional, is whether the report can withstand challenges from parties that are adversely affected — because these investigations are almost always designed to provide the basis for legal action, if appropriate.
It was clear the moment that KPMG’s draft report was leaked in October 2015 that it had failed that test. Not only did it not withstand challenge from affected parties, including former finance minister Pravin Gordhan and former acting SARS commissioner Ivan Pillay, but the firm didn’t even ask for their versions of the story in the way a forensic investigation usually would.
Nor had the report been reviewed by a second partner, as KPMG’s quality control processes require. The firm has admitted its own risk management and quality controls had failed absolutely.
Ironically, KPMG was one of the first of the big four firms to establish a dedicated forensics practice in the early 1990s, led by Petrus Marais, a former head of the Office for Serious Economic Offences, which was then part of the police service.
Marais left earlier in 2017 to set up a boutique forensics arm in consultancy FTI, along with Johan van der Walt, the KPMG forensics partner who led the “rogue unit” probe and was also responsible for the Jacob Zuma and Schabir Shaik corruption investigations.
These resulted in the Shaik case and more than 700 charges against Zuma, as well as an earlier investigation into what went wrong at failed bank Saambou.
All the big four firms have set up dedicated forensics practices over the past 20 years, in line with the global trend, as have some of SA’s large law firms.
There is no regulatory body for forensic investigators as such, though there is an Association of Certified Fraud Examiners. And the larger firms would, or should, have established quality control and professional conduct rules.
A senior partner in one big four firm says the quality standards should be no different in auditing or forensics. There are steps forensic investigations typically follow — including verifying the evidence as well as giving those affected an opportunity to comment on the firm’s draft report.
With so many in the market, however, his firm is moving away from investigative-type forensics, which are often about chasing individuals within companies who are alleged to have done wrong, and is instead starting to focus on more preventative forensic work — for example, helping companies, especially banks, to detect and prevent high-level financial crime.
Whether and how the auditors board can or should broaden its scope beyond audits to the more diffuse sphere of forensics will be interesting to see.
Meanwhile, many in the accounting profession are still agog at the R23m KPMG charged SARS for months of work the firm has since conceded was deeply substandard. But if the saga is to have a constructive outcome, it will be to put the spotlight on professional firms’ forensics activities, as well as their audit practices, and remind them that they have a responsibility not only to clients but to the public to deliver work of a quality and probity that people can trust.
WHETHER AND HOW THE BOARD CAN OR SHOULD BROADEN ITS SCOPE BEYOND AUDITS TO THE MORE DIFFUSE SPHERE OF FORENSICS WILL BE INTERESTING TO SEE