Given the avalanche of corporate and public sector scandals in SA, someone should have asked “who audits the auditors?” long ago. I finally did and quickly discovered that it’s the Independent Regulatory Board for Auditors (Irba). In fact, their findings are public and are made available in their annual public inspections report.
Irba “audits” audit firms at two levels: in terms of the companies’ own systems of quality control and by inspecting individual audit files to determine the compliance of individual auditors to applicable professional standards, codes and legislation in the performance of their work.
According to Irba, one-year results are cyclical, so it is more useful to look at a three-year analysis. Furthermore, all firms accredited to audit JSE-listed companies must be audited once every three years. So how did the top audit companies fare?
In the past three-year cycle Irba issued 26 company-wide quality-control inspection reports on JSE-accredited audit firms and 246 audit engagement reports across these firms. At the company level, only 50% of firms received a “satisfactory” finding. About 42% were regarded as “inadequate” and 8% were referred for “investigation”. Half of the JSE-accredited audit firms failed their own audits. In fact, the main theme of the 2018 Irba report is of a “recurring quality deficiency”.
No wonder we have had Steinhoff, Resilient, Fortress, Ayo…
For the statistics that relate to the actual quality of audits performed by these firms, the picture is equally dire: 56% of audits were regarded as “satisfactory”, 38% as “unsatisfactory” and 6% were referred for “investigation”.
As audits performed by JSE-accredited firms form the basis for almost all investment decisions made by investors, the probability of basing such analysis of a top 40 company on incorrect data is 44%. And about 17 companies’ audits are not worth the paper they are printed on. No wonder we have had Steinhoff, Resilient, Fortress, Ayo…
How many more disasters are lurking in the woodwork? If I were the JSE management, I would have trouble sleeping at night.
SA findings are higher than the global average, but these same firms are not shy to charge for what seems to be particularly shoddy work. In 2018 KPMG, despite its fall from grace, earned R2.4bn in revenues from auditing SA companies.
‘Be transparent’
Here are some choice quotes from the Irba report: “These results are worrying as they are indicative of systemic quality control deficiencies at some firms”; “the results are suggestive that the quality concerns expressed by the market are not unfounded”; and “the high number of audits referred to the investigations [unit] is unacceptable as these are based on fundamental deficiencies on the files”.
But the greatest surprise lies in the following statement: “We strongly encourage auditors to communicate with their clients and audit committees and to be transparent with their inspection results, root cause analyses and remedial action plans. Audit firms must take audit committees into their confidence, and vice versa, to facilitate robust dialogue on matters affecting audit quality.” I have yet to come across a firm that volunteers this information, even when pitching for new business.
Given these revelations I would argue that the only way to clean up shop is for JSE-accredited firms to be obliged to publish their Irba review results on their websites.
When I asked around, I got a good summary of how different firms have fared. KPMG was way down there (though, to be fair, they did disclose this in their first yet “integrated report”, published in 2018). But so were the others. The time has come to start asking the right questions.
• Sygnia uses Deloitte as its external auditor and PwC as its internal auditor.
• Wierzycka (@Magda_Wierzycka) is Sygnia Group CEO.
Would you like to comment on this article?
Sign up (it's quick and free) or sign in now.
Please read our Comment Policy before commenting.