The saga of KPMG and collapsed client Carillion has finally come to a close with an announcement today that the Financial Reporting Council is hitting the firm with a £26.5 million fine, reduced by 30% to £18.5 million due to the firm’s cooperation with the FRC’s investigation. But that’s not all! KPMG Audit Plc was also hit with a fine — £3.5 million reduced by 30% to £2.5 million — as were the two audit partners in charge of the Carillion work for years 2013-2018. All told, it’s a record fine of £21 million ($26 million USD) for work Carillion liquidators implied was incompetent at best. KPMG received £29 million from Carillion over 19 years.
When Carillion collapsed in 2018, 3,000 people lost their jobs and 450 public sector projects including hospitals, schools and prisons were plunged into crisis. Here’s a detailed breakdown of what happened in the years leading up to its spectacular implosion.
The jist of the audit failures, in a wide range of areas, and in respect of a wide variety of items, as described by the FRC:
KPMG failed to gather sufficient appropriate audit evidence to enable it to conclude that the financial statements were true and fair, and failed to consider (adequately or at all) the implications for the audit of evidence suggesting that Carillion’s accounting might have been incorrect or unreliable.
KPMG failed to conduct its audit work with an adequate degree of professional scepticism. Instead of consistently challenging and scrutinising such audit evidence as it gathered, KPMG failed to subject Carillion’s management’s judgements and estimates to effective scrutiny, even where those judgements and estimates appeared unreasonable and/or appeared to be inconsistent with accounting standards and might suggest potential management bias.
Peter Meehan, the engagement partner for financial years ended 31 December 2014, 2015, and 2016, and additional audit work in 2017, got a £500,000 fine — reduced by 30% to £350,000 — for his blatant lack of supervision on Carillion.
Additionally, in the 2016 audit Mr Meehan and KPMG failed in their duties to ensure that the audit engagement was properly managed and supervised. Audit procedures in a range of areas were not completed until more than six weeks after the date of the audit report was signed and records of the preparation and review of working papers were unreliable and, in some cases, misleading. Overall, no effective process was implemented to ensure that all the audit procedures underpinning the 2016 audit report had been completed, documented, and reviewed satisfactorily before the audit report was issued. In light of these deficiencies, Mr Meehan did not have a proper basis to be satisfied that the opinion given in the 2016 audit report was appropriate.
The breaches found in [relation to Meehan’s audit supervision] were not dishonest and in the majority of cases were not intentional, deliberate or reckless. However, there is a finding of a lack of integrity in respect of Mr Meehan’s record of his review of the 2016 audit and four findings of a lack of objectivity. There is one finding of a failure to assess a threat to independence. These breaches are particularly serious because of threir impact on the credibility of the opinions and reports issued by the auditor.
Said KPMG UK chief executive and senior partner Jon Holt on the FRC announcement today: “I am very sorry that these failings happened in our firm. It is clear to me that our audit work on Carillion was very bad, over an extended period … Since this audit work was undertaken, we have done an enormous amount to improve controls and oversight across our firm, to ensure that these failings could not take place today.” This is quite the departure from the words of former chair Bill Michael who said in 2018 that parliamentary accusations of complacency in the Carillion work “does not reflect the hard work and commitment of the Carillion audit team.”
Like its counterpart here in the US, the FRC has been accused for years of being toothless and too soft on audit failures. Seems they’ve taken a page from the PCAOB and aren’t gonna take it anymore.
Sanctions against KPMG LLP, KPMG Audit plc and two former partners [FRC]
As you probably heard,