UK: Sanctions against KPMG LLP, KPMG Audit plc and two former partners

October 12, 2023

This Press Notice concerns the outcomes of investigations into the relevant Statutory Auditor(s). No part of this announcement should be treated as making any findings in respect of the conduct of any other persons or entities.

The Executive Counsel of the Financial Reporting Council (“FRC”) has issued two Final Settlement Decision Notices under the Audit Enforcement Procedure and imposed sanctions against KPMG LLP, KPMG Audit Plc, and two former audit partners following the conclusion of her investigations into the audits of Carillion plc (“Carillion”).

The first Decision Notice (“Decision 1”) relates to the investigation opened on 26 January 2018 into the statutory audit of the financial statements of Carillion for the financial years ended 31 December 2014, 2015, and 2016, and additional audit work in 2017. Under Decision 1 sanctions were imposed against KPMG LLP and Peter Meehan (“Mr Meehan”), a former partner of KPMG LLP and Audit Engagement Partner in all these years.

The second Decision Notice (“Decision 2”) relates to the investigation opened on 12 February 2019 into the statutory audit of certain transactions relating to the financial statements of Carillion for the financial year ended 31 December 2013. Under Decision 2 sanctions were imposed against KPMG Audit Plc and Darren Turner (“Mr Turner”), a former partner of KPMG LLP and Audit Engagement Partner for the financial year ended 2013.

The following sanctions were imposed:

Decision 1

KPMG LLP

1. A total financial sanction of £26,500,000, reduced by 30% to £18,550,000 to reflect the firm’s co-operation and admissions;
2. A published statement, in the form of a severe reprimand;
3. A declaration that the relevant Audit reports signed on behalf of the firm did not satisfy the Relevant Requirements; and
4. An order requiring KPMG LLP to take remedial action aimed at preventing recurrence of the breaches of Relevant Requirements including evaluating and reporting whether the measures taken by the firm since 2017 are sufficient in this regard.

Mr Meehan

1. A financial sanction of £500,000, reduced by 30% to £350,000 to reflect Mr Meehan’s co-operation and admissions,
2. A published statement, in the form of a severe reprimand; and
3. Exclusion from membership of the ICAEW for 10 years. This will run concurrently with the period of exclusion already imposed in other proceedings.

Decision 2

KPMG Audit Plc

1. A total financial sanction of £3,500,000, reduced by 30% to £2,450,000 to reflect the firm’s co-operation and admissions;
2. A published statement, in the form of a severe reprimand; and
3. A declaration that the Audit report signed on behalf of the firm did not satisfy the Relevant Requirements.

Mr Turner

1. A financial sanction of £100,000 reduced by 30% to £70,000 to reflect Mr Turner’s co-operation and admissions; and
2. A published statement in the form of a severe reprimand.
3. The extent of co-operation provided by KPMG LLP, KPMG Audit Plc, Mr Meehan, and Mr Turner, is reflected in the significant discounts applied to the financial sanctions imposed upon them.

KPMG LLP will also pay Executive Counsel’s costs of both investigations which amount in total to £5,324,365.68 and are referred to in Decision 1.

Summary of Findings

The Final Settlement Decision Notices are not published at this stage, but the findings made are summarised below.

Decision 1

Prior to going into liquidation in January 2018, Carillion was a leading UK based multinational construction and facilities management services company. KPMG audited the financial statements of Carillion and its group companies for the financial years 2014, 2015, and 2016. In each of these years, KPMG provided an unqualified audit opinion that the financial statements gave a true and fair view of Carillion’s affairs. The audit opinion for the financial year 2016 was dated 1 March 2017. In July and September 2017 Carillion announced expected provisions totalling £1.045 billion, primarily arising from expected losses on a number of its contracts, and a goodwill impairment charge of £134 million.

In conducting this investigation, the Executive Counsel has taken a proportionate and risk-focused approach to decide the areas to be considered across the relevant years. Despite this the investigation was exceptionally complex and required the analysis of a very substantial volume of information and documents. The resulting findings identify an unusually large number of breaches of Relevant Requirements.

The breaches described below all contributed to the outcome that this very large public company, which had multiple large contracts with public authorities, was not subject to rigorous, comprehensive, and reliable audits in the three years leading up to its demise. In particular, in 2016 KPMG and Mr Meehan’s work in respect of going concern and Carillion’s financial position generally was seriously deficient. KPMG and Mr Meehan failed to respond to numerous indicators that Carillion’s core operations were lossmaking and that it was reliant on short term and unsustainable measures to support its cash flows.

In a wide range of areas, and in respect of a wide variety of items:

KPMG failed to gather sufficient appropriate audit evidence to enable it to conclude that the financial statements were true and fair, and failed to consider (adequately or at all) the implications for the audit of evidence suggesting that Carillion’s accounting might have been incorrect or unreliable.

KPMG failed to conduct its audit work with an adequate degree of professional scepticism. Instead of consistently challenging and scrutinising such audit evidence as it gathered, KPMG failed to subject Carillion’s management’s judgements and estimates to effective scrutiny, even where those judgements and estimates appeared unreasonable and/or appeared to be inconsistent with accounting standards and might suggest potential management bias.

Carillion was a very important client for both KPMG and key members of the audit team during the relevant years. This created a risk to their objectivity. In a number of instances Mr Meehan and other members of the audit team failed to adopt a rigorous and robust approach, accepting the presentation of financial information that suited Carillion’s management.

Additionally, in the 2016 audit Mr Meehan and KPMG failed in their duties to ensure that the audit engagement was properly managed and supervised. Audit procedures in a range of areas were not completed until more than six weeks after the date of the audit report was signed and records of the preparation and review of working papers were unreliable and, in some cases, misleading. Overall, no effective process was implemented to ensure that all the audit procedures underpinning the 2016 audit report had been completed, documented, and reviewed satisfactorily before the audit report was issued. In light of these deficiencies, Mr Meehan did not have a proper basis to be satisfied that the opinion given in the 2016 audit report was appropriate.

Significant and serious breaches were found in each audit investigated. Many of the breaches related to the audit work performed in respect of Carillion’s contracts, including the most financially significant UK and overseas construction and services contracts. These were the core of Carillion’s business, with UK contracts accounting for nearly three quarters of total group revenue. Other breaches related to audit work performed in respect of:

Carillion’s reported debt and its status as a going concern in 2016, including consideration of Carillion’s use of a supply chain finance facility; and

a number of other discrete accounting areas, including Carillion’s 2016 pension liabilities and the testing of goodwill for impairment.

The breaches found in Decision 1 were not dishonest and in the majority of cases were not intentional, deliberate or reckless. However, there is a finding of a lack of integrity in respect of Mr Meehan’s record of his review of the 2016 audit and four findings of a lack of objectivity. There is one finding of a failure to assess a threat to independence. These breaches are particularly serious because of their impact on the credibility of the opinions and reports issued by the auditor.

Decision 2

The investigation related to transactions entered into by Carillion in 2013 that involved changing its provider of outsourced IT and business process services. At the same time as entering into a contract for those services with the new provider, Carillion concluded other agreements, with the same counterparty, involving the assignment of certain IP rights for a significant sum, as well as receiving a further sum as a contribution to ‘exit fees’ payable to the former outsourcing provider. Each of these transactions was treated in Carillion’s financial statements as being independent of each other and this treatment resulted in a significant increase in Carillion’s reported profit for 2013.

A key failing by KPMG and Mr Turner was that they did not obtain sufficient, appropriate audit evidence to satisfy themselves that this treatment was appropriate. KPMG and Mr Turner failed to approach the audit of these transactions with an adequate degree of professional scepticism, failed to consider and respond to the risk of fraud, failed to obtain sufficient appropriate audit evidence regarding the accounting treatment adopted, and failed to identify that disclosures in the 2013 financial statements relating to these transactions might be misleading.

The breaches found in Decision 2 were not intentional, dishonest, deliberate or reckless.

Elizabeth Barrett, Executive Counsel said:

“The credibility of reports and opinions issued by auditors in connection with financial statements depends upon beliefs concerning the integrity, objectivity and independence of auditors and the quality of the audit work performed.

The number, range, and seriousness of the deficiencies in the audits of Carillion during the period leading up to its failure was exceptional and undermined that credibility and the public trust in audit. This is reflected in the financial sanction imposed on KPMG LLP, the highest ever imposed by the FRC.

Many of the breaches involve failing to adhere to the most basic and fundamental audit concepts such as to act with professional scepticism and to obtain sufficient appropriate audit evidence. The breaches in relation to the 2016 audit even include failing to ensure that the audit process itself was properly managed and that the audit file was a reliable record. These requirements lie at the heart of proper auditing.

The seriousness of the failings in the 2016 audit is compounded by the breaches of the Ethical Standards relating to the fundamental principles of objectivity, independence, and integrity.

The non-financial sanctions imposed on KPMG LLP are focused on ensuring that failures on this scale will never be repeated.”

[Financial Reporting Council, UK]