It is perhaps the most seismic finding yet involving a South African auditor, handed down last week in a nondescript boardroom in Modderfontein.
It is, by some distance, the most excoriating ruling against an auditor I have read; that it was handed down against someone who was one of the most senior partners at KPMG, Sipho Malaba, involving one of the country’s largest frauds, the R2bn theft at VBS Mutual Bank, adds to the gravity.
Unlike in many other cases where auditors are accused of negligently bungling an audit — think Steinhoff, Tongaat Hulett or African Bank — Malaba was effectively found guilty of intentionally and dishonestly breaking the rules by a panel convened by the Independent Regulatory Board for Auditors (Irba).
The facts are, by now, well known. Malaba, as a senior partner at KPMG, led the audit of VBS, where he not only signed off on financial statements in which more than R400m was missing, he also helped the bank hide it.
The evidence led in the hearing is astounding: at the same time as he was auditing the bank, Malaba had two secret accounts with the bank in the names of two alter egos — Betanologix and Ihaawu Lesizwe Trading.
Malaba’s two companies ran up “loans” of R25m, and these went “largely unpaid”, the ruling said. VBS — unsurprisingly, given the need to keep its auditor sweet — never leant on him to repay any of it.
Though Malaba was obliged to reveal this to KPMG, he never did. And after the audit firm found out, he promptly resigned.
“[Malaba] is said to have personally profited out of improper conduct in his capacity as the registered auditor to the tune of approximately R25m, in circumstances where [he], as an audit engagement partner, was complicit for a mind-blowing loss of about R2.3bn perpetrated by fraud,” the panel ruled.
Emmanuel Mokutu, the senior counsel who chaired the Irba disciplinary panel, said this case is “in a league of its own” for the outsize impact such auditing failures have had on the public.
Blindly trusting VBS, people in rural Limpopo deposited their hard-earned money with the bank. “They were disappointingly rewarded with a fraudulent audit opinion.”
The harm Malaba caused “is still felt by the customers of VBS Mutual Bank”, while the auditing profession has taken a hit, as his actions “impaired confidence” in the auditing profession among members of the public, said Mokutu in the ruling.
It once again highlights the need for auditors to put the public interest above self-interest
— Bernard Agulhas
To recount the eight charges almost seems to underplay the gravity of this case. But it involved a raft of breaches of the rules, including not bothering to reconcile the numbers, ignoring “overstated” cash balances and allowing “fictitious contract finance agreements” to inflate income.
The evidence Malaba faced included that of junior audit staff, who had tried to warn him of the red flags but had been routinely ignored — again highlighting the importance of whistleblowers in cases like this.
And, critically, it included the testimony given to the Prudential Authority by Philip Truter, VBS’s former CFO, who revealed how Malaba helped him hide a R400m hole.
In particular, Truter recalled a conversation in his office where he told Malaba how this money had gone missing. “That was when he suggested that we just do a reconciliation,” he said.
Or put another way: just make up the audit evidence.
In the end, the ruling found, Malaba had signed off on a “fictitious, non-existent and fraudulent account of VBS Mutual Bank’s financial position”.
Olivier Barbeau, managing partner of Moore Johannesburg, says this case did serious damage to KPMG’s reputation at the time.
“A whole lot of people lost their jobs because of this. The issue is you have to trust that your partners are disclosing what is going on, that your processes are working. And what do you do when they don’t,” he says.
The answer from the disciplinary committee in Malaba’s case is unequivocal: ban them from the industry for life. The penalty that Malaba has to pay — R1.6m (R200,000 for each of the eight charges he was found guilty of) plus R9.2m in costs — seems weighty, but is less than the R25m he took from VBS.
“In a sense, he is lucky: the fines were overhauled in 2024, so had these events taken place after that, he would have been liable for up to R5m per charge,” says Barbeau.
Or a fine of R40m in all, rather than just R1.6m; now that would have sent a far stronger message.
Bernard Agulhas, the former head of Irba who now teaches auditing at the University of the Free State, says the charges are a stark reminder to auditors to pay attention to identifying risks and exercising professional scepticism, among other things.
“This is on a different level from much of what I’ve seen. Most of the investigations into auditors are for negligence, not for assisting clients to commit fraud. It once again highlights the need for auditors to put the public interest above self-interest and to selfishly guard their independence.”
In the absence of that, we’ll continue to see failures like this, he says.
The ramifications of this case are likely to ricochet through the profession for years. But as much as critics will use this as a stick with which to beat auditors, this case is so shocking only because it is by far the outlier.
The vast majority of auditors are ethical and would never so much as skip a stop street. That Malaba ascended so high in KPMG’s corporate structure, to the extent that he was responsible for its banking practice, speaks to just how trusted auditors are within their firms. And of how devastatingly awry it can go when that trust is abused.
Would you like to comment on this article?
Sign up (it's quick and free) or sign in now.
Please read our Comment Policy before commenting.