Quis custodiet ipsos custodes* (Who guards the guards?)

* Satires of Juvenal, 1st century AD

External auditor/statutory auditor: an independent firm engaged by the client subject to the audit to express an opinion on whether the company’s financial statements are free of material misstatements, whether due to fraud or error. For publicly traded companies, external auditors may also be required to express an opinion over the effectiveness of internal controls over financial reporting.

In 2001, the world was exposed to the last major failing of an audit firm where any measure of accountability was taken. Arthur Andersen, one of the then ‘Big Five’ audit firms was found to have failed to identify vast, fraudulently overstated revenue at the energy trading business Enron. The much publicised shredding of working papers by Arthur Andersen staff in an attempt to frustrate investigations amplified the fallout. Since then, the remaining Big Four have held a virtual monopoly over the audits of major corporations around the world, and despite many audit failures, the same situation with the same Big Four prevails with little evidence that audit outcomes have improved. 

In South Africa, there was justifiably outrage over the discovery that KPMG had presented a report to the South African Revenue Service, which it subsequently withdrew as being inappropriate. It was also found that the audit firm had an inappropriate relationship with the Gupta family before firing them as a client in 2016.  Subsequently, the reaction against the auditors of companies where there has been fraudulent representation over many years has been more muted, bizarrely so given the billions that have been lost as a result.

Deloitte is currently giving evidence in defence of its African Bank Investments Limited (ABIL) audit, and is likely to be investigated for its role in Steinhoff. Before the ink was dry on the draft copy of this article, two further audit scandals came to light.  First, PwC provided internal audit services and KPMG provided an external audit to VBS Mutual Bank where it now appears there was significant fraudulent activity, resulting in its 2017 accounts being withdrawn.  Secondly, the amaBhungane Centre for Investigative Journalism discovered that the audit firm Nkonki had been bought out by parties related to the Guptas.  Soon after, the firm and its chosen partner in this case, PwC, received significant consulting work from Eskom on very favourable payment terms.

The only possible reason that the rush by companies to fire KPMG as their auditors has not been matched by similar moves against other audit firms is the stark realisation that there is not much choice. Listed companies and their investors have always preferred their audits to be conducted by one of the prestigious firms, believing that these firms had the capacity to undertake complex audits, were more likely to be independent given their much larger fee base and brand reputation, and attracted better quality employees due to their stature. While these factors do hold true, sadly this does not seem to be any guarantee of an appropriate audit being conducted. Simply firing one of the Big Four auditors and appointing a small audit firm does not make the problem go away. If this audit then becomes the firm’s largest revenue client, it still challenges the argument of independence, as over-reliance on any one client is likely to cloud such a firm’s judgement. 

Despite the shadow hanging over the Big Four, their dominance continues to grow. Grant Thornton, the fifth largest firm in the UK, recently announced that it is pulling out of bidding for large UK audits given the dominance of the Big Four and the firm’s lack of client wins. Facing the prospect of bidding costs of approximately R5 million and perpetually being excluded in favour of the Big Four, they have made the rational economic decision to stop participating, leaving investors the poorer for choice.

While the problems are multiplying, the solutions are not obvious. We face the centuries-old challenge, alluded to in the title, of who will hold these guardians accountable for their own failures. Thus far, it has not been the independent regulatory bodies. South Africa’s regulator of the auditing industry, the Independent Regulatory Board for Auditors (IRBA), is only now getting around to investigating the ABIL audit, and is woefully understaffed to deal with the number of challenges it currently faces.

In order to be an audit partner, you need to be a registered accountant. The South African Institute of Chartered Accountants (SAICA) has yet to publicly rescind the use of its designation by members implicated in the recent KPMG, ABIL or Steinhoff scandals. Groucho Marx famously said, “I would never belong to a club that would have me as a member”. As a member of SAICA, and given the company that I share, I question why I would want to remain a member. This does not appear to be a solely South African problem.  In the UK, it took the Financial Reporting Council, that country’s accounting oversight body, 10 years to review KPMG’s audit of HBOS bank, which failed during the financial crisis. KPMG was found not guilty.

Reinforcing the global angle on audit failure, the Financial Times highlighted a recent report from the International Forum of Independent Audit Regulators indicating that global accounting watchdogs had identified problems at 40% of the audits they inspected in 2017. The most common issue identified by these regulators was a failure among auditors to “assess the reasonableness of assumptions”. The second biggest problem was a failure among auditors to “sufficiently test the accuracy and completeness of data or reports produced by management”.

There is clearly a problem. The issue is how do the users of financial statements resolve it? It will be especially challenging for individual entities to drive the change necessary, given that it is a global problem and outside of regulatory intervention.

The first step we are taking as an organisation is enforcing the mandatory rotation of auditors in the companies in which we invest. While there is already pushback from the companies on this course of action, we think it is the only way to impose some measure of accountability on audit firms. Having a new firm come in and assess the state of reporting and controls with a fresh eye should encourage the incumbent auditor to ensure that its review is up to standard. By allowing a maximum tenure of 10 years, this avoids the additional costs and administrative burden of changing firms too often. However, the common view that the cost of changing audit firms is too burdensome on the companies involved is spurious, considering the cost to investors of fraudulent activity.

The other benefit of mandatory audit firm rotation is that it should change behaviour in asserting the link between the users of financial statements and those that prepare them. For too long auditors have behaved as if the company is the client, whereas in fact the client is all stakeholders who use the financial statements. The auditors need to be cognisant that they are appointed by shareholders, not the executive of the company, and should be beholden to provide them with a quality service.

A problem that is evident from pursuing mandatory audit firm rotation is the limited choice available, with the Big Four dominating the sector. The challenge of growing more competition will require more work and thought by shareholders and regulators. There is an element of a circular argument which needs to be solved. Smaller audit firms do not have sufficient skilled resources to complete the audits of large listed companies. However, they are not prepared to hire more resources if they do not have the client base, and there is no guarantee that they will get the clients once they have hired more staff. In addition, it is best for multinational companies to be audited by a single audit firm rather than by a number of smaller firms working within a global network, to reduce the risk of ‘passing the blame’ between audit firms. In order to break this circle, we need to see stakeholders undertake in advance to move audits to a Big Five or Big Six firm, or a regulatory body like the stock exchange or the IRBA force the random selection of a firm from pre-approved auditors.

While some of these options may seem onerous and unfair, we should remember that the entire auditing profession exists due to a regulatory requirement that a company has audited financial statements. Their ability to generate returns is due to a regulatory mandate. To tweak this regulation to ensure better outcomes for stakeholders is not an unfair request. 

The second issue that needs to be dealt with is the regulation of the industry and its participants. Without a doubt, the oversight of the auditing profession needs to be improved. While a statutory oversight body (the IRBA) exists, the fact that the failings have been so many and so widespread implies it is not succeeding. Improved resourcing is undoubtedly required and a more proactive, rather than reactive, stance needs to be taken. We must also consider those who prepare the financial statements and what level of oversight is required. There is strangely absolutely no regulation over who can prepare the financial statements of a listed company. The only requirement is that “the audit committee must, notwithstanding its duties pursuant to Section 94 of the Companies Act consider, on an annual basis, and satisfy itself of the appropriateness of the expertise and experience of the financial director”.

Another issue to consider is the structure of the audit firm. The auditing profession has always avoided the corporate structure and been structured as a partnership. Having personal liability was supposed to make the partner more accountable. But it does not seem to have worked. While a global brand is used worldwide, accountability and responsibility rest only in the localised regions, preventing aggrieved investors from accessing the global audit firm’s resources. Properly ensuring consistent standards for global auditing firms should be seriously considered so that the entire group can be held accountable for failures. This would drive greater monitoring and compliance within the organisation, as opposed to today’s system where there is very little incentive for the global organisation to monitor its regional operations closely.

In addition, the corporate governance of auditing firms should be addressed. They do not have an independent board overseeing how their operations are run. After the recent lapses at KPMG, the firm has introduced the role of an independent chairperson and a lead independent director. This should become standard for all firms auditing listed companies and state-owned entities.

The regular response from the audit firms to challenges to the status quo has been to complain about how much this will cost them. The reality is we have very little insight into the finances and profitability of these monitors of corporate reputability. It is ironic that those tasked with ensuring transparency in financial reporting are themselves inscrutable organisations where profitability and executive pay are often not in the public domain. Requiring audit firms to report their accounts will help the users of their services to determine the profitability of this industry and of the ancillary services and consulting work that they undertake.

There is a large lobby that believes part of the solution is to break up the firms into separate auditing and consulting operations. I am not in favour of this option, as I think the provision of consulting services makes the businesses more sustainable and helps to attract the right talent. However, what should be in place are strict rules around limiting the ability of current auditors to consult to and audit the same group, and appropriate cooling off periods between providing these different services. The practice of loss leading on the audit to gain a foothold into the organisation to sell more lucrative additional services should also be examined, as it potentially prevents non-consulting audit firms from being competitive.

The fact that so many organisations, tasked with the important societal role of confirming the accuracy of company accounts, are either complicit in fraud or unable to identify inappropriate controls and accounting policies is truly breathtaking. Over the past 10 years, as white-collar crime has soared alongside state capture and theft of public assets, it appears that the entire country’s moral compass has shifted. What is required is a complete reset of values and a strong sense of accountability among members of the profession. The very definition of profession is ‘any type of work that needs special training or a particular skill, often one that is respected because it involves a high level of education’. It is time that the auditing profession starts to show us how it will once again earn our respect.