THE AUDIT PROFESSION AND CORPORATE SCANDALS INTRODUCTION Boreka

THE AUDIT PROFESSION AND CORPORATE SCANDALS

INTRODUCTION • Boreka Motlanthe • Director for Forensic Investigations at ARMS – Audit and Risk Management Solutions • Previously a Criminal Law Lecturer at TSA • Previously Head of Investigations at UNISA

BACKGROUND • Why is it necessary and important to talk to the state of the Audit Profession in the current context? • Why do we even link the profession with scandals? • However; the two (Audit Profession and Scandal) are unfortunately becoming synonymous.

BACKGROUND • I would like us to think of SCANDALS in the Audit Profession as nothing other than FAILURES in applying and adhering to the professional standards • I would like us to see the SCANDALS in South Africa as nothing other than a reflection of the failure in the REGULATION of the profession, unlike in other Jurisdictions

BACKGROUND • The breakdown has gone so low that it is still possible to talk about SCANDALS when talking about the Audit Profession: – In a FORTUNE online magazine report by Madeline Farber on September 20, 2016 it was stated that: • “In a separate case, former partner Pamela Hartford, who served on another audit team, had a romantic relationship with Robert Brehl—the former chief accounting officer of client Ventas, a real estate investment trust, according to the SEC. ”

BACKGROUND • The profession can delve into the realm of scandals too. • We need to be professional at all times to avoid dragging our professions into the “gutter”. • We each need to ask ourselves what is the role that we play in bringing our profession into disrepute – we are not doing much in raising its profile.

ASSURANCE • The IIA talks about three lines of defense – Management ( Primary risk and control responsibility) as the first line; – Internal Assurance structures (Oversight) as the second line e. g Risk Management, HR, Finance, IT and Compliance; and – Independent Assurance [Internal auditor and External auditor] as the third line

ASSURANCE

ASSURANCE • I always imagine Internal Auditors as the line where most of the resistance will come from: • Thus making the work of the External Auditor easy and the Regulatory Authority (IRBA) unnecessary

ROLE OF THE REGULATORY AUTHORITY • In South Africa the Regulatory Authority for Auditors (External) is the Independent Regulatory Board for Auditors (IRBA) – The function of the IRBA is to help create an ethical, value-driven financial sector that encourages investment, creates confidence in the financial markets and promotes sound practices.

ROLE OF THE REGULATORY AUTHORITY • According to the IRBA their functions are carried out by: • Developing and maintaining auditing and ethics standards that are internationally comparable. • Providing an appropriate framework for the education and training of properly qualified auditors and their on-going competence. • Registration of auditors who meet the registration requirements. • Monitoring registered auditors’ compliance with professional standards – Investigating and taking appropriate action against registered auditors in respect of improper conduct. – Developing and maintaining stakeholder relationships to enhance performance, accountability and public confidence.

ROLE OF THE REGULATORY AUTHORITY • To me, there has been a failure in the Regulatory Authority in South Africa (that is not even a concern to us at this point). • The IRBA is still investigating the failures at KPMG and we might get a response one day. In the meantime: – In the Business report of 14 March 2018 Kabelo Khumalo reported that KPMG in South Africa agreed to pay a $100, 000 (R 1 167 951. 41) penalty to the USA’s Securities Exchange Commission as it improperly audited the majority of assets and revenues of a publicly traded company without registering with the Public Company Accounting Oversight Board (PCAOB) • This matter might be receiving attention at the IRBA!

EXTERNAL AUDIT FAILURES • The objective of the ordinary audit of financial statements by the independent auditor is “the expression of an opinion on the fairness with which they present, in all material respects, financial position, results of operations, and its cash flows in conformity with generally accepted accounting principles”

EXTERNAL AUDIT FAILURES • The failure of External Audit within the limited OBJECTIVE are extensive and many; but they are minor if one takes into consideration that the failures at that level are at the last stages of ASSURANCE. • Remember the LINES Of DEFENCE

EXTERNAL AUDIT FAILURES • We have heard of the KPMG failure to identify irregularities with regard to the Audits at the Gupta Owned Companies » [Timeslive 15 September 2017 GRAEME HOSKEN] • We have ignored the incident where KPMG “disavows” [deny any responsibility or support for] a report issued to SARS. [KPMG Website]

EXTERNAL AUDIT FAILURES • They are not the only ones – Deloitte SA faces an investigation by the (IRBA) for the company’s audit opinions for Steinhoff for 2014, 2015 and 2016. (Fin 24 Jan 19 2018 07: 45 Tehillah Niselow) • Unfortunately we are only fascinated by the big scandals because they are drawn to our attention by the media

EXTERNAL AUDIT FAILURES • LONDON — "Big Four" accounting firms KPMG and Pw. C have both been handed multi -million-pound fines for auditing failures, amid growing concerns about the quality of audits from the major providers as reported by Camilla Hodgson Aug. 16, 2017 in http: //uk. businessinsider. com/kpmg-fined-sec-pwc-fined-frc-2017 -8? IR=T – Auditor KPMG has been fined more than $6. 2 million (R 76 million) by the US Securities and Exchanges Commission (SEC) for failing to properly audit an energy company that grossly overstated the value of its assets. – Separately, Pw. C was also hit with a £ 5. 1 million (R 84 million) fine on Wednesday and "severely reprimanded" by UK watchdog the Financial Reporting Council, after admitting misconduct when auditing professional services company RSM Tenon Group in 2011.

EXTERNAL AUDIT FAILURES • The nature of failures that were identified with regard to the PWC fine are the following: • the accrual of bonus payments, • certain aspects in relation to the recognition of work in progress and amounts recoverable on contracts, • the accounting for leases, • the assessment of the impairment of goodwill, and • the calculation of goodwill in relation to a subsidiary.

EXTERNAL AUDIT FAILURES • To bring that closer, recently – Auditor-general Kimi Makwetu has expressed concerns regarding the financial audit that auditing firm Sizwe. Ntsaluba. Gobodo (SNG) did on state-owned arms manufacturer Denel where SNG failed to properly account for irregular expenditure in its report of Denel’s financials. – The Financial Times Limited 2018. All rights reserved.

EXTERNAL AUDIT FAILURES • When one looks at the topic of Audit Failures what usually comes up is the External Auditor that had failed to identify possible irregularities in the Financial Statements • By the time there is a failure by the External Auditor, it means that the Internal Auditor Line has been breached • How often do we talk about the failure of Internal Audit?

INTERNAL AUDIT FAILURES • Differences between Internal Auditors (IAs) and External Auditors (EAs) • Although Internal Audit does have a degree of focus on the financial aspects of the organisation, it is essentially not a financial discipline - unlike its counterpart External Audit. It is an independent , objective assurance and consulting activity designed to add value and improve an organizations operations • Its multidimensional nature mandates a much broader scope in the organisation that of External Audit.

INTERNAL AUDIT FAILURES Internal Auditors are responsible for the following: – Evaluating controls and advising managers at all levels • The Internal Auditor’s work includes assessing the tone and risk management culture of the organisation as well as evaluating and reporting on the effectiveness and efficiency of the implementation of management policies.

INTERNAL AUDIT FAILURES Internal Auditors are responsible for the following: • Evaluating risks • Internal Auditors identify key activities and relevant risk factors and assess their significance. Changing trends and business/economic conditions impact the way the internal auditor assesses risk. • The techniques of internal auditing have changed from a reactive and control based form to a more proactive and risk based approach. • This enables the internal auditor to anticipate possible future concerns and opportunities as well as identifying current issues.

INTERNAL AUDIT FAILURES Internal Auditors are responsible for the following: – Analysing operations and confirming information – Internal Auditors work closely with line managers to review operations then report their findings. The internal auditor must be well versed in the strategic objectives of the organisation, so that they have a clear understanding of how the operations of any given part of the organisation fit into the bigger picture.

INTERNAL AUDIT FAILURES Internal Auditors are responsible for the following: – Reviewing compliance • Compliance review ensures that the organisation is adhering to rules, regulations, laws, codes of practice, guidelines and principles as they apply individually and collectively to all parts of their organisation

INTERNAL AUDIT FAILURES • All these objectives must be performed in compliance with the Professional Standards – The International Professional Practices Framework (IPPF) is the conceptual framework that organizes authoritative guidance promulgated by The IIA that provides internal audit professionals worldwide with authoritative guidance organized in the IPPF as mandatory guidance and recommended guidance.

INTERNAL AUDIT FAILURES • Core Principles for the Professional Practice of Internal Auditing – Demonstrates integrity; – Demonstrates competence and due professional care – Is objective and free from undue influence (independent). – Aligns with the strategies, objectives, and risks of the organization. – Is appropriately positioned and adequately resourced.

INTERNAL AUDIT FAILURES – Demonstrates quality and continuous improvement. – Communicates effectively. – Provides risk-based assurance. – Is insightful, proactive, and future-focused. – Promotes organizational improvement.

INTERNAL AUDIT FAILURES • For an internal audit function to be considered effective, all Principles should be present and operating effectively. – How an internal auditor, as well as an internal audit activity, demonstrates achievement of the Core Principles may be quite different from organization to organization, – Internal audit staff should have the required competencies and skills – but failure to achieve any of the Principles would imply that an internal audit activity was not as effective as it could be in achieving internal audit’s mission

INTERNAL AUDIT FAILURES • There was a failure at the Wells Fargo Bank: – Staff at Wells Fargo opened an estimated 2 million deposit accounts and applied for roughly 565, 000 credit card accounts to meet sales goals – The question asked by By Norman Marks | Oct 28, 2016 in cmswire: • Where Was Internal Audit?

INTERNAL AUDIT FAILURES • To me the most appropriate question to ask is - did Internal Audit perform any work in relation to these accounts? • If the answer to the first question is YES, the next question is – • Whether the work performed by Internal Audit was in line with the Core Principles for the Professional Practice of Internal Auditing?

OUTSOURCED / CO-SOURCED SERVICES • Most of the institutions represented have to, by necessity, use either Out-Sourced / Co-Sourced Service Providers to render ASSURANCE SERVICES • The question to ask is – • To what extent does the service provider comply with the Core Principles for the Professional Practice of Internal Auditing

OUTSOURCED / CO-SOURCED IA • The easiest process would be to confirm that there was Quality Assurance Review of the Service Provider • It also requires that your internal staff complies with those Core. Principles

INTERNAL AUDIT FAILURE • When there is a failure in controls and you have: – Unauthorised; – Irregular – Fruitless and wasteful Expenditure • In some instances plain criminality: – Fraud; – Corruption; – Theft

INTERNAL AUDIT FAILURE • Do these failures get reported? • Is there action taken by management to address these failures? • If there is no action taken, do you then report these lack of consequence management to a higher level?

INTERNAL AUDIT FAILURE • Do these failures get reported? • Is there action taken by management to address these failures? • If there is no action taken, do you then report these lack of consequence management to a higher level?

FAILURE • Remember the biggest failure in an organization is not by the Assurance structures as represented by Internal and External Audit. • The biggest failure is by Management as represented by the First and Second Lines of Defence thus rendering the Third Line Vulnerable to being breached.

AUDIT FAILURE • When there is an Audit failure you then need a proper Investigation to deal with the legal issues aimed at resolving those failures • You need to understand that at this point everything has legal implications and you have to invoke the Fraud Prevention Framework Protocols.

FORENSIC INVESTIGATION • If it is decided that you are going to have an Investigation please ensure that: – It is properly approved; – Those concerned are properly informed; – The Labour Relations and Legal Departments are informed – All the rights of the employees are respected throughout the process; – Ensure that there are plans in place to implement the recommendations

ARMS-AUDIT • We have been in the industry since 2006 and we offer the following services: – – – – – Financial Auditing; Compliance Auditing; Governance Auditing; Computer Auditing; Performance Auditing; Fraud and Forensic Investigation and Auditing; Risk Management and Governance; Asset Management; Assessment of Control Environment; Training • To see all the services we offer, you can also pick up our promotional material.

ARMS AUDIT • QUESTIONS? • THANK YOU