MICHAEL MARCHANT: Errant auditors let off the hook

The Independent Regulatory Board for Auditors (Irba) is doing more than law enforcement agencies to investigate and sanction auditors who have been complicit in state capture. Yet many of these sanctions are wholly inadequate, and pale in comparison with the costs to the country of auditor misconduct. This not only falls short of ensuring genuine accountability; it also undermines public trust in auditors and their regulator. 

A powerful example of the mismatch between conduct and consequence was seen recently, when Irba entered into a settlement with Aaron Mthimunye, MD of assurance at SNG Grant Thornton.  

Mthimunye appeared before the regulator’s disciplinary committee last year for his conduct as audit partner at Eskom for 2015/2016. This was arguably the year in which the capture of the power utility was accelerated. It was, after all, in 2015 that the then newly appointed CEO, Brian Molefe, put in place an executive that included Anoj Singh and Matshela Koko.

This was also the year audit and consulting firm McKinsey was granted a notoriously dodgy mega-contract with Eskom; the deal bypassed proper procurement processes and would in effect result in the utility being fleeced.

And it was the year in which Molefe and the Eskom board allegedly interfered to ensure that mining giant Glencore would sell Optimum Coal Mine to Gupta firm Tegeta. 

Molefe, Singh, Koko and McKinsey were all implicated in state capture in evidence before the Zondo commission of inquiry. McKinsey, Molefe and Singh are also accused of fraud and corruption for their conduct at Transnet, before they worked at Eskom. Koko faces criminal charges for his conduct at the power utility.  

As the audit partner at Eskom, it was not Mthimunye’s job to investigate state capture or the conduct of these individuals. However, it was his job to assess the financial statements, apply professional scepticism to management’s claims and pay particular attention to the requirement that the state-owned entity (SOE) report irregular expenditure and noncompliance with the law.

Irba concluded that Mthimunye had failed on all fronts: he “failed to disclose material noncompliance with legislation and internal control deficiencies”; “failed to maintain an attitude of professional scepticism” in conducting the audit; and failed to “obtain appropriate audit evidence to draw a reasonable conclusion on the amount of irregular expenditure”.

Put simply, Mthimunye issued an unqualified audit opinion even though Eskom had materially misstated irregular expenditure and had such serious internal control deficiencies that the extent of irregular expenditure could not be accurately determined. These were precisely the red flags the public would expect senior auditors to raise.   

For context, Eskom later determined that it had lost nearly R20bn to irregular expenditure between 2012 and 2018. As one of the auditors who kept silent during this period and signed off an unqualified audit opinion, Mthimunye was part of a system that failed to raise the alarm about the extent of the problems at the ailing SOE.

As we head towards possible stage 8 load-shedding this winter, we are all paying the price. 

We welcome Irba’s finalisation of another state capture matter — but the good news stops there. The sanction should have properly reflected the failures that were uncovered and the extraordinary social cost thereof. It didn’t do so. Mthimunye was instead issued a fine of R200,000 and ordered to attend classes on public auditing, and had to pay a further fine, which was, in fact, the highest sanction: payment of R4.9m towards Irba’s legal costs. This was levied only because Mthimunye refused to admit wrongdoing and pay the fine offered to him ahead of the disciplinary hearing.

Regardless, both the fine and the costs order may well be borne by the audit firm anyway. 

Such meagre fines undermine the finding of wrongdoing and do little to deter repeat misconduct. They also leave the public rightly angered.  

Stepping up sanctions

Unfortunately, Irba is limited to a maximum fine of R200,000 per charge for offences that were committed before the law was amended in 2021. The changes made that year allowed the finance minister to raise the maximum fines, in recognition that the previous amount was wholly inadequate. Yet the new regulations have yet to be gazetted, leaving Irba toothless on the fines front.  

Still, Irba does have other powers, including suspension and debarment, which are arguably more important when it comes to sanctioning misconduct and audit failure. These are used in rare and exceptional cases, such as the 2018 debarment of KPMG auditor Jacques Wessels, who audited Gupta firm Linkway Trading.   

Most cases end up with far lighter sanctions. In fact, most are reported by Irba without even identifying the name of the auditor and the firm involved.  

Irba has made progress and shown an appetite to investigate important cases of audit failure. But this is only half the battle; the body’s sanctions need to match the level of misconduct and the public costs flowing therefrom.

With further state capture matters and high-profile fraud cases linked to Tongaat Hulett and Steinhoff on the regulator’s agenda, the public will be watching closely to see if its bite can finally match its bark. 

* Marchant is head of investigations at Open Secrets