Nhlamu Dlomu wears a brave smile as she greets the FM, hurrying to her next meeting. Self-assured and bright-eyed, she does not look like someone trying to save a 120-year-old audit firm from ruin.
Yet this is the task Dlomu (42), a trained clinical psychologist, assumed in September when she was appointed CEO of a tainted KPMG in SA. Dlomu, the first black woman and the first nonauditor to lead the business, was previously KPMG’s head of people and change.
She was thrust into the role following astonishing revelations regarding KPMG’s audit work for the Gupta family as well as its consulting work for the SA Revenue Service (Sars), which led to the resignation of eight partners, including then CEO Trevor Hoole and chair Ahmed Jaffer.
Then, last month, the third strike: two of its partners, Sipho Malaba and Dumi Tshuma, resigned with immediate effect when it emerged they had secretly held personal loans with the bank they were auditing, the controversial Limpopo-based VBS Mutual Bank, which had lent R7.8m to Jacob Zuma to repay his Nkandla debt. These loans had never been declared to KPMG, and raised serious questions about the auditor’s independence — especially given that KPMG hadn’t flagged what later emerged to be rampant fraud at the bank.
"Clearly what has happened at VBS has really disappointed me on a personal level," Dlomu told the FM recently. "I feel let down and it’s difficult not to be angry about it."
Now, from a detailed investigation, including speaking to numerous industry insiders as well as KPMG’s own staff, the FM estimates that since Dlomu took the reins, the firm has lost between 400 and 500 of its staff. Some have joined rivals. KPMG staffers say PwC swooped in, hiring entire teams from KPMG’s consulting division.
Though PwC declined an interview with the FM for this article, it confirmed that it had hired about 80 people from KPMG, who are now employed in its consulting division "in areas where we had vacancies to fill".
"We have not actively recruited individuals from KPMG, and most of the partner leads have come to us via headhunters," says PwC’s COO, Fulvio Tonelli. "It is inevitable that when partners decide to move, the teams that previously worked for them would also consider moving. In the main, these individuals motivated their decision to move given the uncertain future they faced at KPMG."
EY has hired a few KPMG employees too, says CEO Ajen Sita, but only in areas in which it was already actively recruiting. Similarly with clients: it has responded to open tenders from KPMG’s clients, but Sita said it will not be "predatory" in its approach to KPMG’s clients or people.
Other KPMG employees have left the auditing profession, or the country, in some cases transferring to KPMG’s offices overseas. Despite its shrunken staff complement, KPMG still has 2,900-3,000 employees in SA. But from a position of invincibility, it may now be the smallest of the big four audit firms — certainly the most fragile.
EY’s SA operation employs just more than 3,000 individuals and Deloitte and PwC about 4,500 and 4,800 respectively.
The bad news is that KPMG may shrink further. Already, the firm has lost more than a dozen clients, including one of the country’s biggest banks, Barclays Africa.
The FM’s calculations show that the KPMG clients who have axed the firm were paying more than R330m/year in auditing fees. This will leave a void in KPMG’s coffers.
Worse, if Old Mutual were to drop KPMG — and the life insurer has apparently had many exhaustive internal discussions over how to respond to these scandals — the knock would be immense.
Last year, Old Mutual paid KPMG more than R334m (£19.9m). In its annual report, it said that while it was happy with the "quality of the audit", it spent "significant time" discussing the fallout of the KPMG scandals.
Though it chose not to ditch KPMG, it asked a "senior UK KPMG partner to review the quality of the 2017 audits of the SA business". Any further nasty revelations from the VBS scandal and Old Mutual’s patience may run out.
More challenging than resizing the firm or drawing up a new business plan will be rebuilding its reputation.
KPMG’s cosy relationship with the Guptas, which led to substandard audits of Gupta-family companies, and a flaky report into Sars — which damaged the careers of senior Sars officials and aided the gutting of the institution — have all but destroyed its image. At one stage it seemed that good work was being done. Dlomu had acted: governance reforms had been implemented, and a wholesale management shake-up had been carried out.
Sygnia R3.3m
Sasfin R12.5m
Interwaste R4.3m
AVI R11.7m
The Foschini
Group R6.4m
African Rainbow
Minerals R15m
Gaia Infrastructure
Capital R306,297
Barclays Africa R138m
Redefine Properties R9.8m
Sibanye-Stillwater R60.1m
Government
audits by KPMG R74m
Nelson Mandela
Bay municipality R892,786
TOTAL R336m
— AUDIT FEES PAID BY THOSE WHO DITCHED KPMG
But when VBS was placed under curatorship in March, the storm broke afresh. For many, it was the final straw. The problems with VBS included fraudulent related-party deals. And the Reserve Bank, in an affidavit, pointed out that while "corporate deposits" on VBS’s balance sheet were supposedly R900m, it is "uncertain whether all of these deposits represent true deposits".
Nor had KPMG flagged the fact that VBS was flouting the Municipal Finance Management Act by accepting more than R1bn in deposits from municipalities – and deliberately flouting a Reserve Bank directive regarding the repaying of these deposits.
In this context, revelations of the loans that KPMG’s two partners on the VBS audit, Malaba and Tshuma, had with the bank were always going to be extremely damaging.
Dlomu says: "The rules are straightforward — when someone chooses not to do that, I don’t know what motivates them."
VBS tipped the scales. Clients who had given KPMG the benefit of the doubt, while awaiting the outcomes of investigations by the audit and accounting regulators, decided enough was enough.
Barclays Africa, Redefine Properties and Sibanye-Stillwater gave KPMG the boot in the past two weeks. Others left earlier.
Marc Wainer, chairman of Redefine, says the property company’s decision to axe KPMG wasn’t about any dissatisfaction with the audit. "It was just about reputation. With everything going on with Steinhoff and governance of listed companies, we didn’t want to take the risk of anyone not being happy with our financials. And we felt the VBS thing was a step too far," he says.
Similarly, Barclays Africa’s chair, Wendy Lucas-Bull, emphasised at the bank’s AGM this week that KPMG’s audit team had demonstrated "appropriate technical expertise and challenge to management".
Lucas-Bull welcomed KPMG’s new leadership but said Barclays Africa was concerned over the "limited scope" of various independent reviews into the firm’s work.
Significantly, SA’s highest audit authority, the auditor-general, also cut ties — which means KPMG can no longer do work for government. When one of the country’s few remaining upstanding government institutions refuses to do business with you, you know you have a problem.
The proverb that "a good name is more desirable than great riches" has never been more appropriate.
So how did it all go so wrong? Is KPMG simply rotten or are there just a few bad apples, who have bobbed to the surface?
"Whatever happened and whatever the culture in the firm was, it probably existed under the previous leadership and with the new leadership it probably has changed or is not an issue," says Bernard Agulhas, CEO of the Independent Regulatory Board for Auditors (Irba). "If KPMG actually does do what it says it is going to do, it has a chance of getting through this."
Agulhas says Irba is overseeing KPMG’s turnaround plan and helping the firm identify "root causes" to get "a better sense of what is actually happening in the firm".
Ansie Ramalho, an independent corporate governance expert who joined the KPMG board as a nonexecutive director in March, does not believe the company’s culture is irretrievably broken.
April 1 2016
KPMG cuts ties with Gupta-owned businesses, including the then listed Oakbay Investments, citing reputational risk. This brings to an end its 14-year relationship with Gupta-family companies
June 30 2017
The Gupta e-mail leaks reveal that KPMG signed off on the audit of Linkway Trading, which helped launder state funds to pay for the family’s lavish Sun City wedding in 2013 The e-mails show that KPMG partners, including then CEO Moses Kgosana, aended the wedding. Kgosana wrote a gushy thank-you e-mail to Atul Gupta in which he described the wedding as “the event of the millennium” nKPMG SA said of its Linkway audit, “We stand by our work and the audit opinions issued”
June 30 2017
Irba launches a probe into KPMG’s audit of Linkway Trading. This is later expanded to include the work KPMG did for the South African Revenue Service (Sars) and other Gupta companies
July 3 2017
Kgosana resigns from the board of Alexander Forbes. He was due to take up the role of chair the following month
July 28 2017
JSE-listed asset manager Sygnia fires KPMG over its Gupta links August 11 2017 KPMG SA announces a “comprehensive review”, to be undertaken by KPMG International, of its work for the Guptas and Sars
September 2017
Hulisani and Sasfin cut ties with KPMG
September 15 2017
KPMG International’s investigation concludes that its South African unit’s work for Gupta-family companies and Sars fell “considerably short” of KPMG’s standards KPMG announces the resignation of eight partners, including CEO Trevor Hoole and chair Ahmed Jaffer. Nhlamu Dlomu is appointed CEO
September 22 2017
Saica announces that it will investigate members employed by KPMG and implicated in its Gupta company audits Jacques Wessels, facing disciplinary action by KPMG, resigns. Wessels was the lead partner on the audits of non-listed Gupta entities
October 2017
Munich Re, AVI, The Foschini Group, Interwaste, African Rainbow Minerals add their names to the growing list of companies dropping KPMG as external auditor
October 9 2017
Following the mass exodus of partners, KPMG announces the appointment of a new leadership team for SA. This includes the appointment of Gary Pickering to head of audit and Granville Smith to head of advisory
January 17 2018
KPMG announces the appointment of its first independent nonexecutive directors in the form of Ansie Ramalho and Wiseman Nkuhlu, who is to become chair. These appointments are effective March 1
March 11 2018
VBS Mutual Bank is placed under curatorship. KPMG is the bank’s external auditor
April 14 2018
KPMG announces the resignation of the lead audit partners on VBS Mutual Bank. Sipho Malaba and Dumi Tshuma, who did not disclose loans that they held with VBS, resigned facing disciplinary charges
April 15 2018
KPMG briefs the press on a Sunday regarding a ra of new measures it will implement to reassure clients on its ethics and the quality of its audit work. This includes the review of at least 200 audit files going back two years and integrity checks on senior employees
April 30 2018
Old Mutual shareholders vote overwhelmingly in favour of keeping KPMG on as external auditor
May 3 2018
Barclays Africa becomes the first major bank, and biggest client, to cut ties with KPMG, saying it will propose to shareholders to vote against the reappointment of KPMG at its AGM
May 4 2018
Redefine Properties and Sibanye-Stillwater follow suit, ditching KPMG as auditor
May 7 2018
Dlomu says that KPMG is reviewing its business model and assessing how large it needs to be following the loss of clients
— KPMG on the ropes
"There’s been a drift from remembering who we are and why we exist, which is to serve the public interest. [But] my experience does not bear out that there is a systemic issue," she tells the FM. "Having said that, though, one needs assurances. As a non-executive director, I can’t simply go on my experience and my gut feel."
Following the VBS debacle, KPMG announced a host of interventions to reassure clients and the public of the ethical behaviour of its employees and the quality of its audit work. This includes reviewing at least 200 audit files, going back two years, relating to well over 100 companies.
KPMG is conducting integrity checks on senior employees and their partners, a process it will repeat every two years.
It is also running a "speak-up campaign" among staff, opening a hotline and encouraging employees to reflect on whether they have been forced to condone work that was not up to scratch.
This is not without some angst internally. Partners privately bemoan the fact that they are now "being made to feel like criminals".
But the appointments of Ramalho, the former project lead on the King 4 governance code, and professor Wiseman Nkuhlu as independent nonexecutive directors, are further aimed at convincing clients that KPMG is serious about fixing the problems.
Nkuhlu, currently chancellor of the University of Pretoria, was Africa’s only representative on the global financial crisis advisory panel, established in the US to advise on the accounting standards-setting implications of the global financial crisis.
"There is a lot of good in KPMG," says Ramalho. "KPMG is not just an inanimate object, it is a collection of people with families, with dreams, with careers they have built or careers that they have just embarked on. One can’t just willy-nilly come to the conclusion that all of them are aligned with corruption. Like any human being, an organisation consists of good and bad."
It is worrying that some of the measures KPMG is introducing only now have existed for years at other audit firms. For example, Deloitte has had independent nonexecutive directors on its board for more than two decades, while the remaining board members consist of partners who are not in executive roles.
Deloitte’s partners and their spouses are subject to wide-ranging inspections every three years. Executives are inspected every year, having to provide bank statements and documents of all of their investments.
The same is true at EY and PwC, though PwC does not have nonexecutive directors on its governing board, but is considering it.
Agulhas says while the Auditing Profession Act does not require audit firms to have independent nonexecutives, it might be something worth enforcing.
But what this means is that until last September, KPMG SA’s board and its executive were essentially one and the same.
Another red flag is that KPMG had also combined the roles of risk management partner and COO. So it was no wonder that the firm did not seem to have a handle on the risks to which it was exposed and did not, as KPMG International found, adequately apply its own risk management and quality controls.
Should KPMG fold in SA, there would be a sad irony to it. Back in 2002, the big-four firm absorbed the assets and employees of a then embattled Andersen. Andersen had changed its name a year earlier from Arthur Andersen, after its American arm’s criminal handling of US energy giant Enron’s books was revealed.
At the time of KPMG’s takeover of Andersen, KPMG’s Tom Grieve was quoted in the press as saying the deal was in everyone’s best interests "particularly following the recent period of profound uncertainty in the profession".
If only Grieve knew what was coming. Fast-forward 16 years and the profession is facing more upheaval than ever before.
That the profession is in crisis is now beyond debate, Deloitte Africa CEO Lwazi Bam tells the FM.
Grant Thornton CEO Paul Badrick adds: "It’s an indictment across the board. We’ve obviously got to do a lot to win back public confidence."
This is not only true in SA. Auditors across the globe have been found wanting, seemingly at every turn.
In India, PwC was banned earlier this year from auditing listed companies for two years. This came nearly a decade after the collapse of Satyam Computer Services, sometimes referred to as "India’s Enron", which was also found to have falsified its accounts.
In the UK, PwC, KPMG, EY and Deloitte have all come under fire from MPs for internal and external audits and advisory work performed for collapsed construction company Carillion.
In SA the list of possible audit failures keeps growing. There’s the R200,000 fine Irba handed PwC for failing to flag procurement irregularities at SAA.
PwC was also VBS Mutual Bank’s internal auditor, responsible for testing the collapsed bank’s risk management, internal control and governance processes. And we all know how that turned out.
Neither KPMG nor PwC flagged any "reportable irregularities" — fraud, theft and breaches of fiduciary duties or acts that could cause material financial loss — to Irba during their audits of VBS.
All of this while Irba is pursuing disciplinary action against Deloitte over its audit of African Bank and is still digging into Deloitte’s audit files on Steinhoff, the scandal-ridden furniture retailer which admitted to "accounting irregularities" in December after auditors refused to sign the accounts.
More recently, black-owned firm Nkonki applied for liquidation after auditor-general Kimi Makwetu terminated his office’s relationship with the firm — fatal, since Nkonki got 80% of its contracts from government.
Makwetu’s decision was made following revelations by investigative journalism unit amaBhungane that Nkonki’s majority shareholder was actually Gupta lieutenant Salim Essa. It was Essa, it turned out, who had funded Nkonki CEO Mitesh Patel’s R107m management buyout of the firm.
And then there’s KPMG. The firm is facing Irba investigations into its work for the Guptas and Sars, while the SA Institute of Chartered Accountants (Saica) is conducting a separate investigation into individuals at the firm who are implicated in these matters.
"Accounting scandals have always happened," says Mandi Olivier, senior executive for professional development at Saica.
"What is concerning right now is the magnitude and the frequency with which these are occurring in SA. The matter is complex. I don’t think there’s one single reason that explains why this is suddenly happening," Olivier says.
Certainly, audit firms, big and small, are hurriedly cleaning house, lest they be caught in similar scandals.
Almost all the firms the FM spoke to say they have terminated relationships with clients they think are "high-risk" or no longer pass internal screening processes.
Adding to the severity of the turmoil in which the audit profession finds itself is an angry, disillusioned SA public, desperate to see perpetrators of state capture brought to book. There exists a considerable expectation gap — and auditors are feeling the heat.
"The expectation gap has grown substantially in the past couple of months," says Agulhas. "There is not an understanding of what auditors can and cannot do, and what they are mandated to do" in terms of the act.
Says Ramalho: "An audit is designed to provide assurance on whether financial statements are a fair representation and compliant with the applicable reporting framework. An expectation, for example, that an audit should pick up all fraud is not sound and not aligned with [its] primary purpose."
Indeed, if every audit had the scope of a forensic investigation, it would take PwC no longer than the time typically given to a large audit — three to four months — to perform such an investigation into Steinhoff’s books.
Instead, PwC’s probe into fraud at Steinhoff will take almost a year — finishing by December, at best.
But while the average Joe may need a better understanding of what an auditor does, regulators globally have recognised that the educational syllabus may also need an overhaul. For example, perhaps auditors should be trained in forensics too.
In SA, Saica and Irba are working on a project called CA 2025, which seeks to understand what skills future auditors and accountants will need.
"If management sets out to hoodwink the auditors, it’s very difficult to spot that, particularly as businesses have got more complex," says Mark Stewart, CEO of midtier audit firm BDO.
Artificial intelligence will help in automating parts of the audit process and allowing for "continuous auditing" — verifying data in real time and flagging suspicious transactions. Perhaps one day, intelligent machines will replace auditors altogether and fraud will simply be impossible to commit.
But for now, says Agulhas, audit quality generally needs improving. And that is true for all of the country’s large audit firms — not just KPMG. Many of its rivals are undoubtedly thanking their lucky stars for the opportunity to quietly get rid of their own dirty laundry while KPMG’s is aired for all to see.
Cases of unethical behaviour aside, Irba’s latest inspections report suggests audit standards are slipping.
While the report is biased towards higher-risk audit areas — including audits of listed entities, public-interest entities and state-owned companies — the results are still worrying. Sixteen of the 23 firms inspected were found to have "significant deficiencies requiring improvement". The same criticism was levelled at 124 of the 197 audit files inspected (63%), which belonged to 101 firms.
"Deficiencies" include incorrect audit opinions, insufficient documentary evidence to support the opinion reached and material misstatements not being identified or addressed by the auditor.
"Twelve of these audits had fundamental deficiencies that resulted in the auditors being referred for investigation," Irba says in its report, which spans from April 2016 to March 2017 – in other words, well before KPMG’s nosedive began.
Irba’s findings for the previous year found a similar decline in audit quality — implying the problem is getting worse, not better.
Investors should be deeply worried.
In particular asset managers, who invest people’s pension savings in companies based on their audited financials, should be concerned by Irba’s finding that auditors are insufficiently interrogating client information or demonstrating professional scepticism. Nor, in fact, are many auditors testing goodwill assumptions and fair-value assessments as they should — which means some company’s assets may be overstated.
At times, Irba has also picked up related-party transactions that were not spotted by the auditors. In other cases, working papers are created or modified after an audit has been performed and shortly before Irba conducts an inspection date — a disturbingly common practice, suggesting audit firms are trying to cover up flaws in their work.
Perhaps a sharper focus on quality will be the silver lining on the clouds gathered around KPMG and the audit profession.
Already, EY has placed companies and individuals implicated in state capture on a "watch list", in case they approach the firm seeking audit or advisory services, says Sita.
EY has also enhanced its already stringent approval thresholds for taking on new work and over the past 24 months ended relationships with about six clients who it felt posed a "reputational risk", he says.
Smaller firms are doing the same. BDO’s Stewart says: "Our risk processes have been enhanced immeasurably, to the extent that the risk department has been criticised as being a risk to us doing business."
BDO has ended relationships with two listed clients — one due to reputational risks and the other due to fee pressure. "We didn’t believe we could deliver a quality service based on the fees we were being allocated."
This, it seems, has been one of the weaknesses of the profession. In some cases, the regulator found, auditors have accepted clients who lack integrity, or audits they may not be competent to perform, in a bid to keep racking up the fees.
The big four are also reportedly dropping their fees to retain clients, which is placing all firms under pressure.
Arguably, the entire "payer model", in which the client pays the auditor fees, creates an inherent conflict. Can auditors be expected to bite the hand that feeds them?
Deloitte’s Bam would say yes. "No single client is worth our reputation. We can survive the loss of our biggest client, but we can’t survive the loss of our reputation."
Sita says it is critical for firms to recognise that "we serve the public interest".
Still, the payer model feels somewhat unsatisfactory — even if there are no international examples of workable alternatives.
One of the more controversial interventions proposed by Irba is the creation of "audit-only" firms.
This would prevent audit firms from doing any advisory work, like consulting. KPMG, for example, relies heavily on this — it was its consulting arm that performed the work for Sars, for example.
Audit firms, increasingly reliant on their lucrative consulting arms, predictably think it’s a terrible idea.
They argue that given the complexity of companies, it is impossible to deliver an effective audit without input from the likes of technology specialists, engineers and actuaries — subject-matter experts who spend the bulk of their time doing advisory work for nonaudit clients. This pays their salaries.
Agulhas responds that audit-only firms would simply have to appoint these specialist skills in-house to support the audit function. But this would undoubtedly increase audit costs for companies or, worse, leave audit firms without the necessary skills as specialists join advisory-only firms.
"This is not the only solution," he says. "Our concern is a neglect of audit quality.
"We just have to start obtaining high audit quality again."
But a skills exodus, and an inability to attract and retain talent, may be a greater threat to audit quality in the long run — particularly as perception of the risks associated with being an audit partner, for comparatively less reward, escalate.
Stewart says this is a fact: "We’ve got to acknowledge that the audit profession is not an attractive place to be for young professionals these days."
While the CA qualification remains attractive, only about 10% of qualified CAs go on to register as auditors, says Saica’s Olivier.
She tells the FM that Saica has had inquiries from only a few anxious trainee accountants at KPMG.
This may be due to the six-month penalty Saica imposes on trainee accountants who switch audit firms midway through training — a policy it has no plans to waive. "There is nothing to suggest that KPMG no longer qualifies to be a training office," Olivier says.
Saica has engaged the 1,000-odd CAs-in-training employed by KPMG. It has its hands full trying to place the 40-50 trainee accountants who have been out of work since Nkonki’s liquidation.
When it comes to some of the work that KPMG has lost, a number of second-tier firms — such as Mazars, BDO, Grant Thornton and SizweNtsalubaGobodo — say they have had more invitations to pitch for clients which may have not considered them until now.
But in many cases these are just fee-testing exercises, aimed at reducing the existing auditors’ fees, with no intention to swap.
"My first inclination is to find out how serious the bid is," says SizweNtsalubaGobodo CEO Victor Sekese.
"You do get those where the client wants to complete a checklist and has no intention of engaging with you. [Then] you put all your emotions in and realise later we were never going to get the assignment; it’s a real waste."
Repairing the damage to its reputation may be the biggest battle facing KPMG in the months ahead
— What it means
Grant Thornton’s Badrick agrees. "We do these fantastic proposals, but the client comes back to us and says: ‘We like your style but the audit committee wants a big-four firm’," he says.
There’s also mandatory audit firm rotation, which will require companies to change their external auditors every 10 years, starting in 2023.
This "will just be a case of the work being bounced around the big four", Badrick says.
Stewart agrees. "If the experience in Europe is anything to go by, the midtier firms are net losers of work as their clients rotate to one of the big four," he says.
"Audit committees are playing it very safe at the moment and would far sooner have a big-four endorsement on an audit report than put it out to a midtier firm."
BDO still comes across loan agreements where banks stipulate that the borrower be audited by a big-four firm — despite this being effectively anticompetitive.
While there are certain audits, such as of big banks or insurers, that midtier firms don’t have the skills to do, there are plenty others they would be capable of handling.
"Even after all these years in SA of all auditors qualifying in the same manner, the market still believes that only the big four have proper auditing skills," says Yolandie Ferreira, head of external auditing at Mazars Cape Town.
Badrick says midtier firms would need to consolidate to meaningfully challenge the dominance of the big four.
That is, if SA even has a big four left by the end of the year. A big three is a frightening prospect.
Fortunately for KPMG, it has many employees who are fiercely loyal to the firm, even though it has shed nearly 15% of its staff.
Despite the loss of more than R330m in fees, KPMG still has a number of large banking and insurance clients, among others. But if Old Mutual or other clients follow suit, survival would not be guaranteed.
Given its size, even in a smaller format, Agulhas believes KPMG may still be able to compete with big-name rivals.
Ramalho agrees: "KPMG may have to go through a process of refocusing or streamlining, but its existence is not in jeopardy at this time."
Given the flight of clients, this assessment may yet prove to be wishful thinking.
Would you like to comment on this article?
Sign up (it's quick and free) or sign in now.
Please read our Comment Policy before commenting.