We Forgot to Mention KPMG Got Caught Cheating Again

The PCAOB announced Wednesday it has imposed $7.7 million in penalties against KPMG Colombia (Firm: $4 Million Penalty; Individual: $25,000 Penalty), KPMG UK ($2.6 Million), and KPMG India (Firm: $1 Million Penalty; Individuals: $75,000 Penalty) for a variety of infractions. Failure to cooperate with a PCAOB inspection, cheating on training exams, signing off on blank work papers, and improper use of an unregistered firm are among a range of violations that occurred from 2016 to 2021.

In addition to fines, Wednesday’s sanctions include barring or suspending four auditors from participating in public company audits and requiring three KPMG member firms to review and improve as necessary their quality control policies and procedures. One of the sanctioned firms, KPMG S.A.S. (“KPMG Colombia”), admitted that it failed to cooperate with a PCAOB inspection. The firm also agreed to retain an independent consultant to recommend improvements in the firm’s quality controls with respect to internal training.

“These actions should send the message to KPMG and all other registered firms that the PCAOB is committed to rooting out misconduct wherever it occurs and will employ all sanctions at its disposal to protect investors and improve audit quality,” said PCAOB Chair Erica Y. Williams. Reminder to naughty auditors: the PCAOB is comin’ for dat ass.

In the press release, PCAOB Acting Director of Enforcement and Investigations Mark Adler is sure to flex the PCAOB’s muscle. “The breadth of the misconduct uncovered in these matters and the aggregate size of the sanctions imposed demonstrate the global reach of the PCAOB’s oversight and the Board’s heightened vigilance in enforcement,” he said.

Here’s what they got nailed for.

KPMG Colombia

Altered audit documentation, answer-sharing on internal training exams

In the KPMG Colombia matter, the PCAOB sanctioned the firm [PDF] and three of its associated persons – José Daniel Meléndez Giménez [PDF] (“Meléndez”), Edgar Mauricio Ramírez Rueda [PDF] (“Ramírez”), and Marco Alexander Rodríguez Ramírez [PDF] (“Rodríguez”) – for violating PCAOB rules and standards in connection with the PCAOB’s 2016 inspection of the firm. The PCAOB also charged the firm with violating quality control standards relating to audit documentation and the firm’s internal training program.

The PCAOB found that, in 2016, the firm and various individuals improperly altered audit documentation for two audits in anticipation of a PCAOB inspection, and provided that altered documentation to PCAOB inspectors. Meléndez, the engagement partner for one of those audits, directed the improper alterations for that audit, and Ramírez and Rodríguez participated in the misconduct. The noncooperation resulted in part from deficiencies in KPMG Colombia’s system of quality control, which failed to provide reasonable assurance that (1) audit documentation was protected against improper alteration and (2) appropriate control was maintained over administrative passwords that could be, and were, used to backdate changes to work papers.

The PCAOB also found that from at least 2016 to 2020, KPMG Colombia violated PCAOB quality control standards related to integrity and personnel management. Those quality control failures prevented the firm from identifying extensive, improper answer-sharing among firm personnel in connection with tests on internal training exams covering topics that were relevant to compliance with PCAOB rules and standards.

KPMG UK

Answer-sharing on internal training, failing to supervise an unregistered audit firm, violation of PCAOB standards relating to due professional care, audit planning, audit committee communications, and quality control

The PCAOB issued two disciplinary orders against KPMG LLP (“KPMG UK”).

In one order [PDF], the PCAOB sanctioned KPMG UK for violating PCAOB quality control standards related to integrity and personnel management. Similar to KPMG Colombia, KPMG UK failed to detect or prevent extensive, improper answer sharing on tests for mandatory internal training courses. From 2018 until March 2021, hundreds of individuals from KPMG UK and KPMG Resource Centre Private Limited, an India-based entity that provides support for KPMG UK’s issuer audit work, engaged in improper answer sharing. The improper answer sharing occurred in connection with tests for training courses covering topics that included auditing, accounting, and professional independence. All of the professionals implicated in the answer sharing performed work for KPMG UK’s Assurance practice.

Without admitting or denying the findings in the order concerning the improper answer sharing, KPMG UK was censured and agreed to pay a $2 million civil money penalty and to review and improve as necessary its quality control policies and procedures to provide reasonable assurance that its personnel act with integrity in connection with internal training.

In a second order [PDF], the PCAOB sanctioned KPMG UK for failing to reasonably supervise an unregistered audit firm in four consecutive audits of a public company client. In particular, KPMG UK allowed the unregistered Romanian audit firm KPMG Audit SRL to play a substantial role in four consecutive audits in which KPMG Audit SRL incurred as many as 74% of the total audit hours. Compounding the failure, in three of the four audits, KPMG UK erroneously reported that PCAOB-registered firm KPMG Romania SRL, not KPMG Audit SRL, had participated in the audits.

Additionally, KPMG UK was found to have violated, in connection with the same four audits, PCAOB standards relating to due professional care, audit planning, audit committee communications, and quality control. The Board also found that the firm had made several inaccurate filings on PCAOB Form AP regarding other audit clients, disclosing that registered KPMG affiliates had participated in various audits, when in fact separate, unregistered firms had done the work. The firm has since corrected the Form APs at issue and agreed to review and improve its quality control policies and procedures as necessary.

KPMG India

Signing off on blank work papers, failing to supervise engagement team members

The PCAOB also sanctioned KPMG Assurance and Consulting Services LLP (“KPMG India”) and KPMG India engagement partner Sagar Pravin Lakhani [PDF] (“Lakhani”). The sanctions are based on KPMG India’s quality control failures and Lakhani’s supervisory and documentation failures in connection with a practice of signing off on blank placeholder work papers during the 2017 audit of a public company.

The PCAOB found that, in the course of that audit, Lakhani and other members of the KPMG India engagement team signed off on dozens of blank work papers. The blank work papers were replaced with completed work papers, in many cases after the issuance of the audit report, but the sign off dates were not updated. As a result of this practice, the work papers did not appropriately reflect the dates on which the audit work was actually completed and reviewed. KPMG India was aware that its audit software allowed personnel to modify or update audit documentation without modifying the sign off date.

By signing off on blank work papers and failing to appropriately supervise engagement team members who he knew were doing the same, Lakhani violated PCAOB documentation and supervision standards and failed to act with due professional care. In addition, KPMG India violated PCAOB quality control standards because its policies and procedures failed to provide adequate assurance that its personnel would document audit work in compliance with PCAOB standards.

Imposing $7.7 Million in Fines, PCAOB Sanctions Three Firms and Four Individuals From KPMG Global Network [PCAOB]