IRBA – soft-touch audit regulator in turmoil

The “Big Four” audit firms – Deloitte, EY, KPMG and PwC – are regularly implicated in audit failures at both listed private companies and public entities. These failures have devastating public costs; just ask the pensioners and investors who lost more than R200-billion when Steinhoff collapsed, or the South Africans who are being asked to fork out more money to bail out South African Airways. 

The Independent Regulatory Board for Auditors (IRBA) is the regulator tasked with holding auditors to account in cases of misconduct, unlawful or unethical behaviour. As detailed in Open Secrets’ Corporations and Economic Crime Report (CECR): The Auditors – the IRBA has repeatedly failed to live up to this task. The evidence shows that the IRBA does not have sufficient powers to be an effective regulator. It has also often failed to use the powers it does have to effectively deter unlawful conduct by registered auditors.

Read Open Secrets’ Corporations and Economic Crime Report (CECR): The Auditors 

IRBA – failing to fulfil a crucial mandate

Auditors are among the professionals that fail to fulfil their professional and legal duties, and there is evidence that many have been knowingly or negligently complicit in serious economic crimes. Even when their conduct has not been criminal, they have failed to fulfil the public’s legitimate expectation that auditors be independent and exercise professional scepticism when signing off on financial statements, rather than uncritically deferring to management. This is not the IRBA’s fault alone, of course. However, it must answer to the public as one of several regulators in the financial sector that has failed to adequately ensure ethical and lawful conduct in the profession it regulates.

On its website, the IRBA states that its mandate is to contribute to “an ethical, value-driven financial sector that encourages investment, creates confidence in the financial markets and promotes sound practices”.  Despite this, on the rare occasion that auditors have been hauled before the IRBA, a slap on the wrist behind closed doors has been the usual outcome. A crucial way in which the IRBA is supposed to fulfil its mandate of building an ethical financial sector that creates public confidence, is by “monitoring registered auditors’ compliance with professional standards”, and “investigating and taking appropriate action against registered auditors in respect of improper conduct”.  Where it fails to do so, a key deterrent against improper and unethical conduct is lost, and public trust is further eroded. 

Too slow, secretive, and toothless?

While the IRBA has the power to make life very difficult for smaller independent registered auditors, it is less equipped to ensure swift and appropriate accountability for the extremely wealthy and powerful Big Four firms. 

When a Big Four firm decides to dig its heels in and fight disciplinary action, it can result in disciplinary processes dragging on for years, long after the events took place. Such battles become highly legalistic, and the question of whether the auditor has fulfilled their ethical duties is often lost. A good example of this is the IRBA’s disciplinary proceedings against partners at Deloitte for alleged failures at African Bank, which crashed spectacularly in 2014. The IRBA charged the Deloitte partners with misconduct, alleging that they missed red flags in the financial statements that massively overstated future cash flow predictions for the bank, and ignored the red flags raised in their own internal reports. The IRBA called it an “auditing disaster”.

While investors in African Bank lost out dramatically when the bank failed in 2014, it was nearly four years until the IRBA actually instituted disciplinary proceedings for misconduct against two Deloitte partners in March 2018. Deloitte has vigorously defended the proceedings at every step, including alleging that the IRBA’s witnesses lied. It was not until June 2020 that final arguments were heard in the case. At the time of writing, the final findings were still outstanding. 

Such legal battles are also very expensive for the IRBA. In its 2019 annual report, it noted that its expenses linked to disciplinary proceedings had gone up by nearly R15-million due to “an increase in high profile cases”. These expenses will likely continue to rise as it grapples with the fallout from State Capture, and its need to litigate against Steinhoff to access the PwC forensic report into the collapse of Steinhoff, that the latter is refusing to release. 

Even when a disciplinary matter does get wrapped up quickly, the IRBA does not have the necessary punitive powers to deter repeated misconduct. It has also not shown the necessary commitment to transparency and openness that would build public trust in its processes.

A good example of this is the IRBA’s findings against PwC and Nkonki in relation to some of their audit work at South African Airways (SAA). The disciplinary committee in that case concluded that PwC “did not appropriately respond to the risk related to procurement in terms of the requirements of international standards on auditing [and] failed to disclose noncompliance with legislation regarding procurement in the joint audit”. PwC was given the maximum fine – a paltry R200,000 – of which R50,000 was suspended. Nkonki received the same fine.

While this finding seems encouraging, the fine is just a rap across the knuckles compared to the R19-million that PwC and Nkonki were paid for their work at SAA. Since then, PwC has abandoned its earlier protests and announced that they have “used the opportunity to effect the necessary remediation as important lessons are learnt”. Yet again, the cost of PwC’s education was paid by South African taxpayers who bear the brunt of SAA’s failures, while the firm’s partners pocket their proceeds. 

Given the repeated bailouts of SAA by the South African taxpayer and the vast procurement budget of the airline, one would expect that despite the limited fine, the IRBA would have made the effort to publicly condemn such significant audit failure. However, the IRBA refused to publish the names of PwC and Nkonki in relation to this matter. The only reason the public knows that these firms were guilty of misconduct is because of a determined investigation by the Financial Mail. 

This has been an unfortunate pattern in the disciplinary work of the IRBA. Auditors are rarely named in the quarterly newsletter that details the regulator’s investigations and findings. It has often appeared that the IRBA’s desire to protect its members overshadows its responsibility “to enhance performance, accountability and public confidence”, which should include informing the public about dodgy auditors. 

The IRBA’s previous CEO, Bernard Agulhas, agreed that the punitive power of the IRBA was completely inadequate. Speaking on action taken against the KPMG auditors who were complicit in the looting of VBS Mutual Bank, Agulhas said:

“The limits to sanctions are up to R200,000 per charge. The public has expressed its dissatisfaction and termed it a slap on the wrist. We agree. The amount is far too low and so the act amendments currently under way include an important change which will allow the minister of finance to set the upper limit to sanctions from time to time. This will allow the IRBA to apply sanctions which are more appropriate to the scale of the negligence.”

Leadership crisis scuppers new opportunities

Despite the myriad issues outlined above, there were positive signs in the past few years that the IRBA and Treasury recognised that the audit industry faced a crisis. Changes were needed to bolster the regulator’s investigative and enforcement capacity, and to ensure the independence of auditors from their clients. The first step towards the latter was the decision to make the rotation of auditors mandatory, to avoid the frankly obscene cosy situation at a company like Naspers which had PwC as its “independent” auditor for more than 105 years. 

Attempts to increase investigative and enforcement capacity at the IRBA were introduced via the Auditing Profession Amendment Bill. The bill grants the IRBA the power to issue a warrant, to “enter and search premises and to subpoena persons with information required for an investigation or disciplinary process”, as well as creating a duty to disclose information. It also allows for higher sanctions which may serve as greater deterrents. Finally, the bill introduces greater independence on the IRBA’s board by preventing registered auditors from being appointed, to avoid the usual revolving door where the audit regulatory board is staffed by former members of the Big Four firms. As was the case in terms of mandatory audit rotation, the Big Four firms have pushed back hard against many of the bill’s changes.

In a submission to the standing committee on finance, Open Secrets expressed support for many of these proposed amendments. However, it’s clear that they can only partly address the issues facing the audit industry. For one, more systemic changes are required to safeguard audit independence – including the permanent separation of audit and consulting and the creation of audit only firms.

The other factor at play is that the new powers and independence of the IRBA will mean little if the regulator does not energetically use them to ensure accountability and acts independently of the industry it regulates. In the CECR report, we also called on the IRBA to commit to improving its own transparency and information-sharing, including always publishing the names of individual auditors and their firms found to have engaged in misconduct. 

The current reality sits in contrast to that. Instead of communicating a clear new direction to the public, all indications are that the energies of the IRBA are directed inwards as an internal battle plays out over who should lead the board. This all stems to the perplexing decision of the outgoing board to appoint Jenitha John as the new CEO of the IRBA board in April 2020. 

Despite an otherwise lauded career in the audit industry, John was the non-executive director who headed Tongaat Hulett’s audit committee for nine years up to May 2019. This was the period in which Tongaat’s management was presenting completely inaccurate accounts and Deloitte’s auditors were signing them off. The IRBA is currently investigating Deloitte’s conduct at Tongaat. John must now lead an organisation tasked with investigating the Deloitte auditors that reported to her as head of the audit committee at Tongaat. Civil society organisations such as Outa have pointed out that this presents serious conflicts of interest and should have disqualified John’s appointment by the outgoing board of the IRBA. 

Responding to concerns raised, Finance Minister Tito Mboweni, who himself inexplicably delayed the appointment of the new board of the IRBA, announced that he would meet with the new board to discuss the appointment, and to discuss a review of the decision to appoint John. However, because of his delay, John started her work at the regulator with no board in place and the talk of a review of her appointment hanging over her. Employees at the IRBA described these first days to the Financial Mail as “chaos”.

Since the announcement by Mboweni, there has been no public statement on the process. However, it now appears that the review of John’s appointment has led to a potentially irreconcilable split on the new board. In a letter seen by Open Secrets, one board member has submitted their resignation to the minister, citing turmoil and alleging that the board had become entirely dysfunctional due to disagreement on whether John’s appointment was appropriate. 

Last week, the Financial Mail reported on this letter and the internal discord at the IRBA. It also reported new information that suggests that John may have done more than previously reported to flag accounting irregularities and stand up to management long before the Tongaat scandal broke.

However, even if this is true and John is not personally culpable for wrongdoing at Tongaat, public perception of possible conflicts of interest will continue, particularly given that there is still no clear full publicly available account of the conduct of Tongaat’s auditors. This public doubt is now central to the problem the IRBA faces. 

As accounting academic and commentator Khaya Sithole told the Financial Mail: “Leave aside the question of why the IRBA would appoint someone associated with one of the entities being investigated for accounting fraud, the [perception] alone is paralysing. When Irba investigates Deloitte’s role in Tongaat, who will believe the outcome?”

Urgency is required

The reported turmoil at the IRBA is a deeply disturbing state of affairs that must be urgently addressed. Despite many of the IRBA’s shortcomings, it is the regulatory body that South Africans are looking to ensure accountability from those audit firms that have been complicit in economic and corporate crimes. Possible audit failures at Steinhoff, Tongaat Hulett, EOH and SAA, that cost pensioners and the wider public billions of rand, are just some of the matters on its plate. But if it is to face off against the power of the Big Four firms, it cannot do so while compromised by internal discord. 

Unfortunately, it is to Mboweni that we have to turn for an urgent intervention. His track record when it comes to essential financial sector regulators is not a good one. As indicated, he was months late in appointing the IRBA’s new board – thus creating a vacuum in leadership at a key moment for the organisation. When he does act, he does not do so transparently. Open Secrets and the Unpaid Benefits Campaign have had to take the minister to court to open up the appointment process for the new commissioner of the Financial Sector Conduct Authority – a process that is itself nearly two years delayed.

Whatever happens, the South African public cannot wait years for the situation at the IRBA to be resolved. It would appear that the most appropriate course of action would be for John to step aside and for a new board to undertake a fully transparent and participatory process to appoint a new CEO. The IRBA can then set upon the vital task of holding the auditing giants to account. DM

Open Secrets is a non-profit organisation which exposes and builds accountability for private-sector economic crimes through investigative research, advocacy and the law. Tip-offs for Open Secrets may be submitted here.

Previous articles in the Unaccountable series are:

Unaccountable 00001: Dame Margaret Hodge MP – a very British apartheid profiteer; 

Unaccountable 00002: Liberty – Profit over Pensioners; 

Unaccountable 00003: Dube Tshidi & The FSCA: Captured Regulator?; 

Unaccountable 00004: Rheinmetall Denel Munition: Murder and mayhem in Yemen; 

Unaccountable 00005:National Conventional Arms Control Committee: handmaiden to human rights abuse?; 

Unaccountable 00006: Nedbank and the Bank of Baroda: Banking on State Capture.

Unaccountable 00007: HSBC – The World’s Oldest Cartel

Unaccountable 00008: FNB and Standard Bank- Estina’s Banks

Unaccountable 00009: McKinsey – Profit over Principle

Unaccountable 00010: Jacob Zuma – Comrade in Arms

Unaccountable 00011: Thales – How to buy a country

Unaccountable 00012: John Bredenkamp – Agent of BAE Systems

Unaccountable 00013: Fana Hlongwane – Agent of BAE Systems

Unaccountable 00014: BAE Systems: (Profit) Before Anything Else

Unaccountable 00015: The BAE Corruption Bombshell

Unaccountable 00016: Deloot- How Deloitte gets away with it.

Unaccountable 00017: EY- Incompetent, Negligent or Criminal?

Unaccountable 00018: KPMG – At the heart of state capture.