Audit firm EY — Incompetent, Negligent or Criminal?

See the Open Secrets volume 2 Corporations and Economic Crime Report (CECR)

See last week’s instalment here

Of the Big Four, KPMG, PwC and Deloitte have all been publicly implicated in instances of corporate fraud and state capture in South Africa. EY has not been in our local headlines. As such, one might assume that EY (formerly Ernst & Young) is the more trustworthy of the Four. That is until one examines the international financial media. There you find a laundry list of illicit dealings by the firm – including allegations of fraud, tax evasion, money-laundering, sexism and whistle-blower intimidation. 

Then there’s the Wirecard scam, Europe’s biggest corporate fraud since the end of World War II. The daily revelations about the dodgy dealings of the fintech company have led many to wonder whether its long-term auditor and consultant EY was complicit in the scam. It has also added to the urgent calls for immediate reform of the auditing profession. 

Germany’s Enron

On 25 June 2020, Wirecard, the German multinational payments processing company filed for bankruptcy. Yet just a few weeks earlier, on 2 June, its long-time auditor EY had given it a clean bill of health in a draft opinion. According to the draft opinion given to Wirecard and obtained by the Financial Times (FT), EY concluded: “based on the findings of our audit, the attached annual financial statements comply in all material respects with German commercial law applicable to corporations and give a true and fair view of the net assets and financial position of the company”.

EY’s draft opinion rejected allegations made by a Wirecard whistle-blower and the findings of a special audit by KPMG, conducted at the request of Wirecard. The allegations, backed up by reports from the FT, were that profits at Wirecard’s key Third Party Acquirers (TPAs) in Dubai, Singapore and the Philippines in particular, were fraudulently inflated. TPAs are businesses licenced by a big payment network (like Visa or Mastercard) to help businesses accept credit card transactions. There were also allegations that Wirecard provided fake customer names to EY. 

The allegations were true. Ultimately, EY had “missed” a €1.9-billion hole in Wirecard’s finances. When it filed for insolvency, Wirecard admitted that the €1.9-billion supposedly held in third-party bank accounts simply did not exist.

Despite the extent and depth of the fraud, EY gave Wirecard unqualified audits for a decade. As more is revealed about the inner workings of Wirecard — including the alleged dodgy dealings of its Russian intelligence-affiliated chief operating officer, Jan Marsalek — it is emerging that the company had long been operating a scam using fake sale transactions to inflate its revenue and profits. 

There were many signs of fraud which a sceptical auditor should have picked up on. According to FT, as early as 2008, the head of a German shareholder association was questioning Wirecard’s spurious accounts. In 2015, the FT began reporting on unverifiable financial records of Wirecard in its House of Wirecard series. Furthermore, several short-sellers, including Jim Chanos’ Kynikos Associates, had started shorting Wirecard’s stock following whistle-blower allegations of accounting fraud at Wirecard.

Wirecard fired back at short-sellers and the FT, claiming that they were attempting to manipulate its share price. FT journalists Dan McCrum and Stefania Palma reported active surveillance following their reporting on Wirecard. Wirecard was backed by the German financial regulator, the Federal Financial Supervisory Authority known as BaFin. BaFin responded by banning the shorting of Wirecard’s stock and initiated a criminal investigation into FT and its journalists for market manipulation and “unethical reporting.”

BaFin, like so many financial regulators, chose to protect the interests of the corporations it was tasked with regulating, spending most of its energy pursuing the actors who were seeking to reveal criminality. This suspect behaviour by the regulator has prompted a separate investigation in the aftermath of Wirecard’s insolvency.

Short selling or “going short” is betting that the share price of a company will go down. A short-seller borrows the shares/stocks, in the hopes that the price will go down so that once it does, they make a profit. Short-sellers buy a stock and then sell them immediately, at the current market price; then when the stock declines in value they buy them back from the lender at the new significantly lower price Investors will often short a stock if they identify that the company is misrepresenting its finances and overstating its value.

To allay concerns about its accounting, Wirecard commissioned a forensic audit by KPMG in 2019. The report released by KPMG in April 2020 revealed how Wirecard’s management had, after contracting the investigation, undermined it at every turn. They stymied attempts to acquire the contracts, account statements and bank confirmations of its TPAs and commercial partners for the periods 2016-2018 (the period that was the subject of the investigation). These were where the accounts which Wirecard claimed held the €1.9 billion were. 

It has since been revealed that for the three years in question, EY was similarly unable to access these documents for verification purposes, but that they were “reassured” by the Wirecard management board’s assessment measures. This is highly questionable conduct for an independent auditor. Professional standards require auditors to use professional scepticism and a questioning mind when analysing the finances of a company. Verifying bank balances is considered auditing 101. 

An independent auditor should not simply rely on the word or “assessments” of executives who have a vested interest in obfuscating fraud. This is particularly the case in the context of numerous allegations of such fraud from internal whistle-blowers and financial journalists. EY’s failed audits of Wirecard thus indicate either complicity or negligence, both which paint the firm in a negative light.

Where were the auditors? Where they always are of course – at the heart of the meltdown

The fraudulent accounting practices at Wirecard and the machismo of its CEO, former KPMG auditor Markus Braun, and its CFO, Jan Marsalek (alleged Russian intelligence affiliate and arms dealer), have led to the scam being referred to as Germany’s Enron. 

The collapse of the US energy giant, Enron, revealed massive corporate fraud and how deeply embedded its auditor, Arthur Andersen, had become in Enron. Andersen not only failed to report the company’s overstated profits and money-laundering by executives; but when US investigators started closing in on the vast fraud at Enron, its senior audit partner ordered the immediate destruction of physical and electronic documents. This spelt the beginning of the end for the firm.

Despite what should have been a crucial learning curve for the auditing industry and their regulators, audit firms have continued in many instances to rubber-stamp inaccurate financial statements, aiming to please clients rather than preserve the interests of shareholders and, ultimately, of the economies in which the public and private companies they audit operate. 

Every time a fraud this massive is uncovered, the first question asked is: “Where were the auditors?” To this, Enron and Wirecard short-seller, Jim Chanos replies: “Who cares? Almost every fraud has been audited by a major accounting firm.” 

Therein lies the auditing industry’s biggest crisis: credibility. 

EY’s litany of ‘irregularities’

Wirecard is one in an ever-growing list of EY’s accounting irregularities. 

In 2008, US corporate giant Lehman Brothers investment bank declared bankruptcy. From 2001 until its collapse, it had employed EY as its independent external auditor. Like at Wirecard, EY maintained a long-term relationship with Lehman Brothers but also provided “advisory services” as consultants. 

During its tenure at Lehman, EY oversaw a process in which the bank began using “Repo 105”, an unorthodox financing transaction that allowed the bank to look like it was in better financial health than it really was. EY not only failed to disclose this to the Lehman Brothers board, but failed to flag the bank’s impaired assets. EY also did not inform the bank’s audit committee that a senior vice-president in Lehman’s financial division had raised red flags about the firm’s use of Repo 105.

There is evidence that EY ignores whistle-blowers even when they are senior EY employees. Former EY partner Amjad Rihan alerted EY of money-laundering and compliance failures by one of EY’s clients, Kaloti, the largest gold refinery in the United Arab Emirates. A UK court awarded Rihan £10.8-million due to being forced out of the firm following his whistleblowing. EY was also found to have “colluded with Dubai authorities to cover up the damaging findings that Kaloti Jewellery International was involved in laundering billions of dollars in cash”. 

EY has also been caught up in possibly the biggest economic crime of all time — Danske Bank’s €230-billion money-laundering scheme. The scam implicated a number of banks linked to Danske. In February 2019, after being implicated in Danske’s money laundering, Swedbank hired EY. A mere five days later, Swedbank had no choice but to fire EY when it emerged that EY was also under investigation for its own role in the Danske scandal.

Swedbank would learn that it could not rely on the services of any of the other Big Four firms or another audit firm, Grant Thornton. Between 2010 and 2014, Danske Bank had switched between Grant Thornton, PwC, KPMG, Deloitte and EY, ostensibly to ensure quality by rotating auditors. Not one of these firms identified or reported the extensive evidence of money laundering and suspicious transactions through Danske’s Estonian branch. They all signed off unqualified audits.

The independence conundrum

In 2019, the UK’s regulator, the Financial Reporting Council (FRC), reported that none of the Big Four firms had surpassed the 90% target that classifies audits as good quality. One of the reasons for declining audit quality is the long-term relationships that auditors build with their clients. EY’s relationships with Lehman Brothers and Wirecard are testament to this. 

In most economies, the Big Four are the only auditing firms large enough to audit big multinational corporations and state-owned enterprises. This leads to extremely high market concentration. In South Africa, 96% of the companies on the JSE are audited by one of the Big Four, and many of these relationships are long-standing. Most of these firms employ members of the Big Four as consultants as well. While audit rotation will soon be mandatory in South Africa, the Danske scandal is proof that rotation is not enough to fix the problem. 

The dual role of the Big Four as consultants and auditors results in an “independence conundrum”. That is, the commercially lucrative consultancy services compromise the credibility of the auditing side of the firm. A notable decline in the quality of audits performed by the Big Four suggests that the Big Four are failing to strike and maintain the balance between auditing and consulting.

The public cost

The public cost of audit failure is immense. It has resulted in job losses, the failure of several large corporations and vast losses for pensioners and other investors. Deloitte’s conduct at Steinhoff and Tongaat Hulett are South African examples of a global phenomenon. Former EY client Lehman Brothers’ collapse was seen as the catalyst in the sub-prime mortgage scandal that precipitated the global financial crisis. The financial contagion led to extensive job losses, an economic downturn, and enforced austerity across the globe. Lehman Brothers became a symbol of the interconnectedness of the global economy and the unbridled impact of mega-corporations on the livelihoods of ordinary people. 

Despite all of this, neither EY nor Lehman has been sufficiently held to account for their conduct. EY settled one case, with the New York attorney-general, for $10-million. They also settled a class-action suit brought by investors for $99-million. Despite paying what are tiny penalties for a firm worth over $30-billion, EY has not admitted any wrongdoing and has not divulged the full extent of its advisory services for Lehman Brothers. It remains to be seen if European regulators will hold them to account for Wirecard.

Closer to home in South Africa, the public still impatiently waits for accountability for the executives of Steinhoff and Tongaat Hulett, and a full independent investigation into how Deloitte got the audits of both companies so wrong. EY’s escapades in Europe and the United States show that the impunity enjoyed by powerful corporations like the Big Four is a global phenomenon.

As the world hurtles deeper into the twin crises of the Covid-19 pandemic and the economic recession — the Wirecard saga unravels and envelops institutions and individuals across several jurisdictions. From Europe, Asia, and North America and even to South Africa, where Wirecard has a subsidiary in Cape Town. The profound impacts of the collapse of Wirecard will be felt across the world. It is thus imperative that this time, the bean-counters bear full accountability for the global misery their negligence and complicity causes. EY cannot continue to be unaccountable. DM

Open Secrets is a non-profit organisation which exposes and builds accountability for private-sector economic crimes through investigative research, advocacy and the law. Tip-offs for Open Secrets may be submitted here.

Previous articles in the Unaccountable series are:

Unaccountable 00001: Dame Margaret Hodge MP – a very British apartheid profiteer;

Unaccountable 00002: Liberty – Profit over Pensioners; 

Unaccountable 00003: Dube Tshidi & The FSCA: Captured Regulator?; 

Unaccountable 00004: Rheinmetall Denel Munition: Murder and mayhem in Yemen; 

Unaccountable 00005:National Conventional Arms Control Committee: handmaiden to human rights abuse?; 

Unaccountable 00006: Nedbank and the Bank of Baroda: Banking on State Capture.

Unaccountable 00007: HSBC – The World’s Oldest Cartel

Unaccountable 00008: FNB and Standard Bank — Estina’s Banks

Unaccountable 00009: McKinsey – Profit over Principle

Unaccountable 00010: Jacob Zuma – Comrade in Arms

Unaccountable 00011: Thales – How to buy a country

Unaccountable 00012: John Bredenkamp – Agent of BAE Systems

Unaccountable 00013: Fana Hlongwane – Agent of BAE Systems

Unaccountable 00014: BAE Systems: (Profit) Before Anything Else

Unaccountable 00015: The BAE Corruption Bombshell

Unaccountable 00016: Deloot — How Deloitte gets away with it