Internationally, KPMG should be investigated by the Department of Justice in the U.S. and by the European Parliament in Brussels, and the question that should be asked of them is whether they knew. Out of that investigation a decision could be made as to what the censure of KPMG worldwide should be. After all, the argument goes, if such activity could take place in South Africa, affecting the very fabric of an emerging market society, then what is to prevent such activity taking place in other countries; Germany, for example. Or Greece. Or Brazil.
Recall that when Arthur Anderson went down for their audit of Enron conducted through their offices in Texas, the entire South African operation of Arthur Anderson, as well as the operations of Arthur Anderson in every other country in which they operated, went down. Every single Arthur Anderson employee worldwide lost their jobs owing to the actions of individuals in a single branch of their U.S. operations, in Houston.
Were KPMG in the U.S. to have written a report propping up false accusations that the Federal Tax authorities in the U.S. had gone rogue and were committing fraud and stealing from Federal coffers; and were that report to be revealed to be false and have led to the firing of the Secretary of the Treasury – it is self-evident that critics would have called for the entirety of KPMG’s operations worldwide to have already been shut down.
Yet, one needs to be somewhat more level-headed about this than the Department of Justice and the U.S. prosecutor were in the days that Enron and Arthur Anderson went down. For one thing, the removal of Anderson ironically increased systemic risk in the U.S. and worldwide. There were, at the time, five audit firms globally that were large enough and sophisticated enough to audit major banks and other large and complex corporate institutions. With Anderson’s removal, there were only four left.
Banks are very complex institutions. They have primarily non-physical assets and liabilities that make up their balance sheets, and these assets and liabilities are represented in terms of instruments and positions that require substantial knowledge to even understand.
A single vanilla call option on an underlying commodity such as white maize can involve non-linear pricing functions, uncertain future cashflows, counterparty risk, yield curves that differ between institutions, and currency risk whenever a trade is made in any currency other than the domicile currency or reporting currency.
On each side of the balance sheet there is deep complexity. It can take a team of auditors several months to audit a bank – the team itself needs to be structured into smaller teams, each of which specialises in particular products or business areas within the bank, and it can take years of repeated audits to get individual candidate auditors to the point where they adequately understand the bank’s activities, even within the limited areas in which individual teams are conducting their annual audits. As an example, the auditors appointed by the bankruptcy attorneys that were tasked with winding up Lehman’s affairs post the investment bank’s collapse, estimated it would take ten years to unravel Lehman’s complex derivative positions.
Additionally – and adding to the burden of compliance – it is a requirement for banks to not only be audited in terms of their statutory audit, but also to be audited in terms of their regulatory requirements. This is to ensure that the multitude of daily, monthly and annual regulatory reports that are required under the Bank’s Act to be submitted to the central banking authorities – in South Africa’s case to the South African Reserve Bank – are accurate and true.
To ensure integrity, and to discourage malfeasance, it is a law in South Africa that the Reserve Bank can demand that specific banks require two audit firms to audit them annually, both from a statutory and a regulatory perspective. And, bearing in mind the complexity of banks’ balance sheets, only those audit firms that have sufficient manpower, know-how and experience, are deemed capable of performing either the primary audit or the regulatory audit of a single bank.
With the removal of Arthur Anderson from the mix, this means that there exist at present only four firms worldwide that are indeed capable of auditing banks. As an example, of the largest 100 banks in the U.S., only two make use of auditors that are not “Big Four” auditors. In South Africa this means that the largest four banks – each of which has roughly a ZAR 1 trillion balance sheet – each require two of these four firms in any given year to perform either months of work in primary audit activities, or months of work in regulatory audit activities.
Were KPMG to be sanctioned and ultimately removed from this pool, despite the argument that auditing talent would quickly migrate from KPMG to the other three firms, there would still remain an enormous and untenable skills and capacity gap. Logically, and mathematically, two of the remaining three audit firms would have to act either as the primary auditor or regulatory auditor on three of the four major South African banks, and one would have only two to concern themselves with. There simply is not sufficient management capacity over audit personnel to ensure that the four big banks in South Africa would be adequately assessed, and systemic risk within the system would undoubtedly be increased.
Unbeknownst to most people, it is a legal restriction on banks within South Africa that they are not allowed to fire or change their own auditors without agreement from the South African Reserve Bank, and this is for good reason. For institutions this important to the South African economy, representing the majority of bank accounts – both of private individuals and of businesses – to be subject to the potential whims, or internecine corporate battles that may ensue between Chief Financial Officers of banks and their auditors, over issues involving regulatory arbitrage, as an example, is unacceptable systemically.
It was for this reason that the Reserve Bank recently, at the time of writing, gave gentle guidance to all of the banks that they should restrict themselves from over-reaction. That they should understand the systemic risks; those emanating from an inherent skills shortage in the audit community, as well as the potential knock-on effect on business confidence, should rash action be taken against KPMG.
There are times for the moral high-ground to be taken, and certainly many have been tempted to adopt this stance; but logically, the reduction of the audit pool to three participants in a market with four large diversified banks, would be extremely deleterious to confidence and would, operationally, be nigh on impossible to manage.
The irony here is twofold; first that KPMG is too big to fail and the conclusion is that irrespective of what they did – no matter its severity – they cannot be allowed to fail. Secondly, the SARS report, which stands out head and shoulders as their worst and most cynical crime, is one that has very little to do with audit as a profession.
It was a report that could have been written by any consultant, it just needed the renown and cachet of the KPMG brand. It seems particularly mendacious for those KPMG partners involved in the SARS report to have so indelibly scarred the previously-admired and idealised brand of KPMG – and audit as a profession – for a piece of work out of their advisory division.
One should clearly understand that Arthur Ander-son’s demise meant that the pool of choice for banks got disproportionately smaller. In fact, the reduction of five big global audit firms to number only four effectively made each and every one of these firms too big to fail. When questions were asked, for example, as to how it was possible for Ernst & Young, Lehman’s auditors for the seven years leading up to their unceremonious failure, to miss the “massive accounting fraud” that had been taking place within the investment bank for years, the answer was never to propose the audit firm’s demise.
Ernst & Young’s fault in auditing Lehman, if considered any worse than negligence, was far less injurious than having Arthur Anderson audit personnel assist with the destruction of materially important documentation, as occurred in Enron’s offices. Also, even as early as 2007, it was recognised by Federal and Treasury authorities that – like the banks – the world’s four largest audit firms are simply too systemically intertwined with the global financial system as a whole to warrant contemplation of failure on the part of even one of them.
In fact, in hindsight, the damage to global markets – as well as to world economic stability – of allowing Lehman to fail, is regretted by many commentators. It is a sobering lesson of the extent to which the free-market liberal capitalist system has outgrown its teenage years, and now functions independently of its paternal state governing bodies, when one contemplates that the world may have actually been a better place now, were Lehman in it. Firms such as Goldman Sachs comply today with the rules set by their regulators, but the relationship is no longer so one-sided as it was before the roaring nineties.
As it happens, in the case of Ernst & Young, the audit firm was accused, in a 2010 lawsuit, of having facilitated the accounting fraud that Lehman had perpetrated. The claim was for the repayment of the USD 150 million in fees Ernst & Young had charged for the audit over a seven-year period. To put this in perspective, that’s around USD 20 million per year, which is miniscule in comparison to Lehman’s balance sheet at the time, never mind the eye-watering size of Lehman’s exposure to the credit default swap and collateralised debt obligation markets.
After the matter was settled for the much lower amount of USD 10 million, Eric Schneiderman, the New York Attorney General said in a statement he gave: “If auditors’ reports ... provide cover for their clients by helping to hide material information, that harms the investing public, our economy and our country.” That is pretty much the same kind of argument one could make in respect, for example, of the audits KPMG performed on behalf of Linkway or Oakbay – the much-vilified Gupta companies.
As an interesting aside, it is worth noting that in an arbitration panel held a year prior to Schneiderman’s statements – in respect of Lehman’s claim against Ernst & Young for malpractice, the ruling was made – according to Reuters – that any wrongdoing linked to the accounting maneuver was “overwhelmingly attributable to Lehman.” In fact, Ernst & Young went on to state the following: “Lehman’s audited financial statements clearly portrayed Lehman as what it was – a highly leveraged entity operating in a risky and volatile industry; and Lehman’s bankruptcy was not caused by any accounting issues.”
This is essential to understand: there is a great difference between auditing a firm’s accounts and passing judgement on their business model. If an auditor signs off accounts that are inaccurate, that is in breach of audit rules. If, however, to their knowledge, they sign off accounts that they believe to be accurate, the fact that those same accounts indicate ridiculously excessive leverage – 33 times in the case of Lehman at the height of its affairs – is technically beyond the scope of audit per se.
In consideration of the questionable audits for which KPMG South Africa is being accused and flayed within the press – these are, in fact, the arguments to be made. Perhaps the authorities will use the Ernst & Young case as a guide in their deliberations.
But, this is not the central issue. The central issue is how it was possible for KPMG partners to write and propagate a false report on behalf of SARS, and how it was possible for them to use the integrity of the audit profession to dress this report over with the cloth of trust and veracity. The answer is very simple. It is because roughly half of the business of audit firms – surprising as this may seem – is not audit at all, and thus is not regulated.