The EY point is interesting. I'm not sure if it's still this way, but when I worked there, a lot of care was put on audit clients as the partner(s) signing off the work had effectively unlimited liability, and could lose pretty much all their money in a worst case scenario.

Unfortunately audit work, where the company decides on their auditor, has an in-built conflict of interests. If the auditor is too harsh/rigorous, then they risk losing the audit. If they're too lax and miss something material, then they risk lawsuits and regulator attention.

Then for large companies there's further complications liket doing the audit may preclude a company from doing other (more lucrative) consultancy work, or that large companies essentially only use one of 4 companies to do their audits, which leads to people rotating through that but little effective competition.

> The EY point is interesting. I'm not sure if it's still this way, but when I worked there, a lot of care was put on audit clients as the partner(s) signing off the work had effectively unlimited liability, and could lose pretty much all their money in a worst case scenario.

Does it ever pan out the way? I'm speaking of the liability on the partners. There have been a number of these in recent times involve pretty much all of the big firms.

Arthur Andersen was a large accounting firm which went bankrupt after their client Enron went belly up. https://en.wikipedia.org/wiki/Arthur_Andersen

It's a double edged sword for Audit companies. On one hand if they get hard on auditing, their clients may not keep them for longer but on the other hand if they stay soft and more scandals like these happen under their watch then the genuine clients may not keep them because they don't do auditing properly and find issues earlier.

There actually seems to be very little accountability for the audit firms when this happens.

https://www.google.com/url?sa=t&source=web&rct=j&url=https:/...

> If the auditor is too harsh/rigorous, then they risk losing the audit

How is this a thing ?

In my experience with auditors, harsh/rigorous does not necessarily mean better because the auditor’s mindset makes an enormous difference. I’ve had process-focused people spend days of their time and mine digging into things that do not have a material impact on results. Unfortunately, even if people have the best intentions, I think that process-focused-but-loose and results-focused-but-rigorous can be easy to mix up, especially for people not in the weeds.

Because it is an absolute race to the bottom (on price) when it comes to Big 4 audit. There is really no distinction or difference in services provided between the firms. You can practically switch from EY to one of the other three (if they don't mind excluding themselves from consulting work) overnight.

Disclaimer: work for Big 4 but in tech consulting, not audit.

OTOH it was the Big 5 until Arthur Anderson gave up its license due to the Enron fraud.

So there's an incentive to audit correctly.

There's the same kind of incentive not to be the closest moth to the lightbulb, and yet....

The race-to-the-bottom/die-at-the-bottom reward structure only prevents disaster if the racers are invested for the long term. The agents in charge will have a high tolerance for that kind of risk if they hope to retire/sell before the money train jumps the tracks. I don't know if that's a hazard this industry is currently falling into, but it's a likely failure mode if nothing sufficiently enforces agents taking a long view.

Because you can switch to another firm which is more friendly to you.

There are certain practices that a company does, and various auditors have different opinions on it. For example, in PCI there are ways of interpreting certain requirements: and when you choose an auditor, you want one that agrees with your approach, and don't want the one that insists on different approach.

Auditing large corps is a profitable business with only a few players "capable" of doing. If one auditor asks too many questions the competitor is happy to take over.

I have a relative in finance and he says this sort of issue is a lot more prevalent, it's just easier to hide when things are good. When times are bad it's more difficult so more get found out. But it's important to remember that people have been sounding the alarm about Wirecard for years and Worecard, the German government and German Finance Authority (BaFin) have gone after the short sellers and journalists who have tried to expose it. Very few involved have any incentive for these to be uncovered, those that do generally have a lot less power than those that don't want it found out and they will happily use that power to intimidate and destroy their opponents.

I would have almost said "blockchain"... But in all seriousness, if nobody bothered to cross-check 1.9 Bn in the Phillipines, even after all the reports hat came out, the Sigapore investigations and so on, even blockchain wouldn't have done a lot of good. One call at the Phillipines banks would have been enough...

Warren Buffet would say that when the tide goes out you see who is swimming naked.

> They were satisfied with a clumsy fake audit certificate for 2 billion euros in a Philippine account! For how many companies EY did the same? How superficially do they check their customers?

A lot.

Like a lot a lot.

The entire* commodities sector is built on promises like this.

The entire shipping and freight sector.

The entire commercial paper market.

Its promises, redundancies, assurances, and credit.

It usually doesn't go wrong. As long as bond holders get their 2% and common stock shareholders get wiped out, everything is A-OKAY.

(entire is hyperbole, the point is clear, don't be that guy)

But the commodities sector has entire organisations built around checking that cargo of cane sugar /coffee really is what it says what it is.

Edited for spelling

> But the commodities sector has entire organisations built around checking that cargo of cane sugar /coffee really is what it says what it is.

Do the companies pick their own checkers?

See: Hin Leong Trading for a current example.

and by "massive forgery" it just means "normal forgery" but with a few extra zeroes typed in.

this is how the whole world works! on relationships and clout, not technology and verifications. everyone at the bottom has to deal with those pesky assurances of credibility. others are just getting random people with law degrees to provide attestations saying that their client's document is legitimate.

When the scam is big enough, there are consequences for the auditors. Enron sank Arthur Andersen, for example. Didn’t hurt the consulting arm (now Accenture) though.

I initially understood this to mean Accenture changed its name as a consequence of the Enron/Arthur Anderson scandal. But Anderson Consulting changed its name to Accenture in January 2001, and the scandal only became public later that year.

Seems like the two companies weren't very close even before that, the name change was required as part of a legal settlement with Arthur Anderson.

https://en.wikipedia.org/wiki/Accenture#Split_from_Arthur_An...

That split was always pretty interesting to me. It seemed Andersen Consulting bristled at being attached to Arthur Andersen, mostly because Andersen Consulting had to pay 15% of their profits to Arthur Andersen. I figured that the limited partnership nature of consulting/accounting businesses meant that even individual divisions maybe felt their business was their business. The breakup started in 1997, but yeah it was ironic that they had agreed to jettison the name right before Arthur collapsed.

Pretty sure that the partners in Anderson took a big haircut after Enron.

If you audit basically the entire global economy every year and you're going up against people willing to forge & collude something is going to slip through each year. Sure you may catch 99% of the cases. But that one that does make it through has people asking stuff like:

>For how many companies EY did the same? How superficially do they check their customers?

Public perception of audits is basically a giant example of survivorship bias. All the stuff that auditor do catch generally gets fixed without it making the news. Cause you know confidentiality.

It's not a widget factory where six sigma is possible. It's a messy imperfect process, because well the global economy & most businesses are. 100% is about is plausible as demanding that all programmers globally write bug free code. It's just not happening.

That said...2 billion is like 1/3rd of the company assets. That's one hell of an oversight even in light of the above.

I'm wondering why the CEO called in KPMG for an independent audit. Was he expecting a different result? Or he just picked them to break the news?

Buys him time, the audit was necessary otherwise bonds/loans became due or a finance line would be withdrawn. By switching to KPMG he bought himself some time, probably to hide some of the assets they would likely try to seize, so that once he has done his 18 months he can go back to his multiple homes and yachts and live comfortably.

KPMG in german stands for Keiner Prueft Mehr Genau: nobody checks thoroughly anymore. I guess he just thought they would provide the desired result...

At some point you start believing your own lies so he probably thought everything would be fine and the markets would be calmed with another auditor confirming the results.

This exactly. Allegations of fraud had also bubbled up several times in the past and he was able to take care of them. I would imagine he didn't expect this time to be any different.

Auditing is required by law.

Auditors work on assumptions, they assume that the document presented to then are correct and not falsified. If they cannot see that the document is falsified and didn’t see any indications that might raise questions either, how can they be held liable?

OTOH, why does a German company keep 2 billion euros in a Philippine account, that’s strange.

How can you find out about who is auditing a company?

For public U.S. companies, the annual shareholders' report (available on the company's web site) usually includes a letter signed by the auditors certifying that the reported financial results are accurate.

Same in France

They have to sign the books that its done properly.