KPMG's audits of Carillion and the FRC's sanctions

analysisCarillion's audit committee reports state that KPMG was appointed as the company's auditor at its inception in 1999. The House of Commons committees' joint report states that KPMG audited Carillion for all 19 years of its existence and over that period charged £29 million in audit fees, alongside charges for taxation and other assurance services, and that the financial statements show KPMG never offered a qualified audit opinion. Two KPMG entities held the appointment in Carillion's last years. Carillion's 2014 audit committee report states that KPMG Audit Plc resigned as auditor on 13 March 2014 under section 516 of the Companies Act 2006 and that on 13 May 2014 the directors appointed KPMG LLP as auditor to fill the casual vacancy under section 485(3); the 2014 accounts state that auditors' remuneration for 2013 related solely to amounts paid to KPMG Audit Plc and for 2014 solely to amounts paid to KPMG LLP. Companies House records the company, number 03110745 and incorporated on 2 October 1995, as KPMG Audit Limited, with the previous name KPMG AUDIT PLC for the period from 2 October 1995 to 24 September 2024. ^{1 2 3 4}

analysisCarillion's 2014 audit committee report states that, following publication of the 2013 results, Peter Meehan succeeded Darren Turner as KPMG's Group Audit Partner for Carillion, Mr Turner attending the May 2014 annual general meeting before relinquishing his responsibilities; the 2016 report names Mr Meehan as Group Audit Partner, attending each audit committee meeting in 2016. The notice of 12 October 2023 from the Financial Reporting Council (FRC) describes both as former partners of KPMG LLP: Mr Turner as Audit Engagement Partner for the financial year 2013, audited by KPMG Audit Plc, and Mr Meehan as Audit Engagement Partner for the 2014, 2015 and 2016 audits and the additional audit work in 2017. ^{3 1 5}

analysisThe audit committee rated KPMG's effectiveness as external auditor at 4.9 out of 5.0 in its February 2015 review and 4.7 out of 5.0 in its February 2017 review, and recommended reappointment; in its 2014 report it stated that it had discussed with the Group Audit Partner the findings of the FRC's Audit Quality Review of KPMG's work on the financial year ended 31 December 2013, which it said supported its view that KPMG remained effective. The 2014 report stated that the group would tender its audit by the year ending 31 December 2019 and rotate to a new audit firm by the year ending 31 December 2023. The 2016 report stated that, in view of regulatory changes and the change of Group Finance Director with effect from 1 January 2017, the timing of a tender would be kept under annual review and that the company would not renew or enter into an audit engagement with KPMG for the financial year beginning 1 January 2024. Andrew Dougal, the audit committee chair, wrote in 2018 that he was generally happy with the level of challenge and scrutiny KPMG offered the committee, that no tender was held in 2017 mainly because a new Finance Director had very recently been appointed, and that in late 2017 he concluded that a retender should be held in 2018 and was agreeing this with Justin Read, who was replacing him as audit committee chair, when the company went into liquidation. ^{3 1 6}

analysisAndrew Dougal's letter of 5 April 2018, citing KPMG's letter to the committees of 2 February 2018, lists KPMG's statutory audit fees for Carillion as £1.8 million in 2008, £1.3 million in 2009, £1.5 million in 2010, £1.4 million in 2011, £1.5 million in 2012 and 2013, £1.3 million in 2014 and £1.4 million in 2015 and 2016, an average of £1.46 million; he wrote that, although he could not say for certain, the acquisition of Alfred McAlpine completed in 2008 was likely a significant part of the higher fee that year. Carillion's audit committee reports give KPMG's total fees as £1.7m for 2013 (audit £1.5m or 88%, non-audit £0.2m or 12%; paid to KPMG Audit Plc), £1.6m for 2014 (audit £1.3m or 81%, non-audit £0.3m or 19%), £1.8m for 2015 (audit £1.4m or 78%, non-audit £0.4m or 22%) and £1.6m for 2016 (audit £1.4m or 88%, non-audit £0.2m or 12%). Non-audit services in 2014 related to tax advisory and compliance work towards regulatory reports for a potential transaction, and in 2016 to tax advisory and other assurance services. ^{1 2 3}

analysisKPMG LLP's audit report on Carillion's 2014 financial statements, signed by Peter Meehan as senior statutory auditor on 4 March 2015, stated that its opinion was unmodified. It identified as the risks of material misstatement with the greatest effect on the audit the recognition of contract revenue, margin and related receivables and liabilities (total revenue £3,493.9 million) and the carrying value of goodwill (£1,519.1 million); set materiality at £9.0 million, 5.9 per cent of normalised group profit before tax; and subjected five of the group's ten reporting components to audits for group reporting purposes and three to specified risk-focused procedures. It noted that KPMG's report on 2013 had included the timing of revenue recognition from licence arrangements among the risks with the greatest effect on the audit, a risk it considered less significant in 2014. The 2016 report, signed by Mr Meehan on 1 March 2017, was again unmodified, stating that the financial statements gave a true and fair view of the group's and parent company's affairs at 31 December 2016 and of the group's profit for the year. KPMG set group materiality at £8.0 million (2015: £8.0 million), 5.4 per cent of normalised group profit before tax of £147.8 million; the risks with the greatest effect on the audit were contract revenue and margin recognition, a new 'other revenue judgements' risk on £20.0 million of licence income, and the carrying value of goodwill (£1,571.0 million). KPMG stated that it had nothing material to add or draw attention to regarding the directors' viability statement or the disclosures on the use of the going concern basis. ^{1 2}

analysisKPMG LLP's independent review report on Carillion's half-yearly financial report for the six months to 30 June 2017, signed by Peter Meehan on 29 September 2017, concluded under the International Standard on Review Engagements (UK and Ireland) 2410 that nothing had come to its attention indicating that the condensed financial statements were not prepared, in all material respects, in accordance with IAS 34 and the FCA's Disclosure Guidance and Transparency Rules. The report states that a review is substantially less in scope than an audit and expresses no audit opinion. The board continued to adopt the going concern basis 'notwithstanding that the interim balance sheet shows a net liability position'. ³

analysisThe House of Commons committees concluded that KPMG, having audited Carillion for 19 years and been paid £29 million, never qualified its audit opinion, 'instead signing off the figures put in front of them by the company's directors', and that 'in failing to exercise—and voice—professional scepticism towards Carillion's aggressive accounting judgements, KPMG was complicit in them'. They noted that KPMG's 2016 report described contract revenue risks only in general terms, while its February 2017 presentation to the audit committee had described the traded position on contracts as 'challenging' though 'reasonable' when considered with the provisions. These are conclusions of a parliamentary select committee report, made while KPMG's audits were under FRC investigation. KPMG replied that its 2014–2016 audit work and its 2017 work were the subject of the FRC's ongoing investigation, that it 'respectfully' disagreed with the committees' characterisation of its audit work as 'complacent', which did not reflect the hard work and commitment of the Carillion audit team, and that a company failing after an unqualified audit opinion 'does not automatically mean the auditor did a bad job'; KPMG's head of audit had told the committees she did not believe 19 years was 'too long to be impartial'. In October 2023 the FRC's settlement decision found serious breaches of relevant requirements in KPMG's 2014–2016 audits and imposed on KPMG LLP a financial sanction of £18,550,000 after a 30% discount. ^{1 2 3}

analysisThe committees also reported that the FRC's 2015 corporate reporting review of Carillion's accounts raised twelve issues, from a lack of clarity in goodwill assumptions to an inadequate explanation of a significant decline in the book-to-bill ratio; that Carillion made the requisite disclosures in subsequent accounts but the FRC did not review the following year's accounts or investigate further; and that the FRC had not reviewed KPMG's auditing of Carillion's accounts since 2013, looking more closely at the accounts and their audit only after the July 2017 profit warning. They concluded that the FRC had been 'far too passive' in relation to Carillion's financial reporting. The FRC's chief executive told the committees that 'with hindsight, clearly it would have been better to have had a further look', but that the FRC 'did not think that the lack of disclosure was symptomatic of something more serious'. In its response to the report the FRC stated that it 'followed up with a review of the 2016 accounts' and started a review of the 2016 audit following the July 2017 profit warning, while its letter of 21 March 2018 states that its Corporate Reporting Review team reviewed Carillion's December 2015 and December 2011 accounts; the FRC's accounts thus differ from the committees' on whether the 2016 accounts were reviewed, and the retained documents do not resolve the point. The FRC added that its audit powers were aimed at overall audit quality and had not been envisaged to prevent the failure of individual companies, that confidentiality requirements prevented it from publishing views on individual company audits, and that it now intended to enhance its focus on the audits of companies which appear to be in danger. In 2018 the Secretary of State for Business asked Sir John Kingman to conduct a comprehensive independent review of the FRC's governance, impact and powers, writing that its capabilities and culture needed to be strengthened; Kingman told the committees that their Carillion report formed 'a very important part of the context' for the review. The FRC's investigation into KPMG's audits of Carillion for 2014 to 2016, opened on 26 January 2018, ended in the October 2023 sanctions. ^{2 1 4 3}

analysisAccording to the FRC's 2023 notice, its investigation into the statutory audit of Carillion's financial statements for 2014, 2015 and 2016 and additional audit work in 2017 was opened on 26 January 2018; the committees report that on 29 January 2018 the FRC announced an investigation under its audit enforcement procedure into KPMG's auditing of Carillion's financial statements from 2014 onwards, with particular focus on the company's 'use and disclosure of the going concern basis of accounting, estimates and recognition of revenue on significant contracts, and accounting for pensions'. KPMG welcomed the investigation, stating that 'it is important that regulators acting in the public interest review the audit work related to high profile cases such as Carillion'. On 19 March 2018 the FRC announced investigations into the conduct of the former finance directors Richard Adam and Zafar Khan in relation to the preparation and approval of the financial statements. A second audit investigation, into certain transactions in the 2013 financial statements, was opened on 12 February 2019. ^{1 2}

analysisResponding to the committees' joint report, the FRC's chief executive wrote that its investigation would focus on whether KPMG breached audit standards and whether the two accountants within its remit committed misconduct, reviewing four years of audit files, KPMG's and Carillion's emails and company documents, interviewing employees and instructing an independent expert witness. The FRC stated that it had begun an audit quality review of the 2016 audit after the July 2017 profit warning, which showed that the case for enforcement action should be considered, and that the committees' points on goodwill, reverse factoring and other matters would form part of the investigation. It explained that the case against the auditor proceeds under the Audit Enforcement Procedure, which requires a breach of relevant requirements, while the accountants in business are investigated under the Accountancy Scheme, whose misconduct test is much higher. ^{3 4}

analysisOn 25 July 2022 the FRC announced sanctions against KPMG LLP, a former KPMG partner and four former KPMG employees after an independent Disciplinary Tribunal, following a five-week hearing in January and February 2022, made findings of misconduct concerning the provision of false and misleading information and documents to the FRC's Audit Quality Review (AQR) inspectors in connection with KPMG's audits of Regenersis plc (period ended 30 June 2014) and Carillion plc (period ended 31 December 2016). The proceedings were brought under the FRC's Accountancy Scheme, and the Formal Complaint did not allege misconduct in the performance of the audits, nor that the financial statements had not been properly prepared. KPMG admitted liability for the acts of all the individuals and that those acts amounted to misconduct; it was fined £20 million, reduced to £14.4 million to reflect self-reporting, co-operation and admissions, severely reprimanded and ordered to appoint an independent reviewer of its AQR policies and procedures, and agreed to pay £3.95 million towards Executive Counsel's costs of the investigation, together with the costs of the Tribunal. The Tribunal's report was not published at the time. A national newspaper later described the outcome as a settlement, whereas the FRC describes Tribunal findings after a hearing, with sanctions determined at a further hearing in May 2022. ¹

analysisFor the inspection of the 2016 Carillion audit, the independent Disciplinary Tribunal found that minutes of year-end 'clearance' meetings and an audit working paper on the selection of construction contracts for testing (the 'CCS Paper') were presented to the inspectors as having been created during the audit, and that they were false or misleading. It found that Peter Meehan had assisted or encouraged the creation of the false or misleading minutes and was, with three of the former employees, party to the dishonest misleading of the AQR inspectors; in respect of the CCS Paper it found that Mr Meehan acted without the integrity required of an accountant, but not dishonestly. A further allegation against him about the content of the minutes was found not proved. Mr Meehan was excluded from membership of the Institute of Chartered Accountants in England and Wales (ICAEW) for 10 years and fined £250,000; the four former employees received exclusions of seven or eight years with fines, or a severe reprimand. The FRC notes that the Tribunal's findings, whose report was not published at the time, relate only to the members and member firm who were subjects of the proceedings. KPMG admitted liability for the acts of all the individuals; no statement by Mr Meehan responding to these findings was found in the retained documents. The FRC's separate October 2023 settlement decision on the 2014–2016 audits imposed a further 10-year ICAEW exclusion on Mr Meehan, running concurrently with this one. ^{1 2}

analysisOn 12 October 2023 the FRC announced that its Executive Counsel had issued two Final Settlement Decision Notices under the Audit Enforcement Procedure, concluding her investigations into the audits of Carillion; they are settlement decisions reflecting the respondents' co-operation and admissions, and the decision notices themselves were not published when the outcome was announced. Under the first, KPMG LLP received a financial sanction of £26,500,000, reduced by 30% to £18,550,000 to reflect the firm's co-operation and admissions; a severe reprimand; a declaration that the relevant audit reports signed on its behalf did not satisfy the Relevant Requirements; and an order to take remedial action, including evaluating and reporting whether the measures it had taken since 2017 were sufficient. KPMG LLP also pays Executive Counsel's costs of both investigations, £5,324,365.68, and the Executive Counsel described the financial sanction as the highest ever imposed by the FRC. The same decision also sanctioned Peter Meehan, the audit engagement partner for the Carillion audits of 2014 to 2016. ¹

analysisThe FRC's summary of findings for the first October 2023 settlement decision states that KPMG gave unqualified opinions on Carillion's 2014, 2015 and 2016 financial statements, the 2016 opinion being dated 1 March 2017, and that Carillion was 'not subject to rigorous, comprehensive, and reliable audits in the three years leading up to its demise'. It found that in 2016 the work of KPMG and its engagement partner Peter Meehan on going concern and Carillion's financial position was 'seriously deficient', failing to respond to numerous indicators that core operations were loss-making and reliant on short-term and unsustainable measures to support cash flows; that breaches concerned the most significant UK and overseas construction and services contracts, reported debt and going concern including the use of a supply chain finance facility, 2016 pension liabilities and goodwill impairment testing; and that KPMG failed to gather sufficient appropriate audit evidence and to apply adequate professional scepticism to management's judgements and estimates. Carillion was a very important client for KPMG and key members of the audit team, creating a risk to their objectivity, and in a number of instances Mr Meehan and other team members accepted 'the presentation of financial information that suited Carillion's management'. In the 2016 audit, procedures in a range of areas were not completed until more than six weeks after the audit report was signed, records of the preparation and review of working papers were unreliable and in some cases misleading, and Mr Meehan 'did not have a proper basis to be satisfied' that the 2016 opinion was appropriate. The FRC records 'a finding of a lack of integrity in respect of Mr Meehan's record of his review of the 2016 audit', four findings of a lack of objectivity and one finding of a failure to assess a threat to independence. The findings are summarised by the FRC's Executive Counsel from the unpublished settlement notice, which reflects the respondents' co-operation and admissions; the FRC states that the breaches were not dishonest and in the majority of cases not intentional, deliberate or reckless, and that the notice makes no findings about any other persons or entities. In 2018 KPMG had told the committees that it respectfully disagreed with their characterisation of its audit work as 'complacent' and that a company failing after an unqualified audit opinion 'does not automatically mean the auditor did a bad job'; no later public response by KPMG or Mr Meehan to the 2023 findings was found in the retained documents. For these findings KPMG LLP's financial sanction of £26,500,000 was reduced by 30% to £18,550,000 and Mr Meehan's of £500,000 to £350,000, reflecting his and the firm's co-operation and admissions, each with a severe reprimand; Mr Meehan was excluded from ICAEW membership for 10 years, concurrently with the exclusion already imposed in other proceedings, and the FRC declared that the relevant audit reports signed on behalf of KPMG LLP did not satisfy the relevant requirements. ^{1 2}

analysisThe FRC's second October 2023 settlement decision concerned the audit of certain transactions in Carillion's 2013 financial statements. According to the FRC's summary, Carillion in 2013 changed its provider of outsourced IT and business process services and, at the same time, concluded other agreements with the same counterparty for the assignment of certain IP rights for a significant sum and for a further sum as a contribution to 'exit fees' payable to the former outsourcing provider; treating these transactions as independent of each other resulted in a significant increase in Carillion's reported 2013 profit. The FRC found that KPMG Audit Plc and Darren Turner, a former KPMG LLP partner and the 2013 audit engagement partner, did not obtain sufficient appropriate audit evidence that this treatment was appropriate, did not approach the audit with adequate professional scepticism, failed to consider and respond to the risk of fraud, and failed to identify that the related disclosures in the 2013 financial statements might be misleading. The findings are summarised from an unpublished Final Settlement Decision Notice reflecting the respondents' co-operation and admissions, and the FRC stated that the breaches were not intentional, dishonest, deliberate or reckless; beyond those admissions, no separate public response by KPMG Audit Plc or Mr Turner was found in the retained documents. KPMG Audit Plc received a financial sanction of £3,500,000 reduced by 30% to £2,450,000 to reflect the firm's co-operation and admissions, a severe reprimand and a declaration that its audit report did not satisfy the Relevant Requirements; Mr Turner received a financial sanction of £100,000 reduced by 30% to £70,000 to reflect his co-operation and admissions, and a severe reprimand. ¹

analysisCarillion's 2014 and 2016 audit committee reports state that the group's internal audit function was outsourced to Deloitte LLP; the 2014 report lists representatives of the internal auditors (Deloitte LLP) and the external auditors (KPMG LLP), and the Group Head of Risk, Robin Herzberg, among those attending committee meetings by invitation, and the committee rated the internal audit function 4.8 out of 5.0 in December 2014 and 4.7 out of 5.0 in December 2016. The House of Commons committees state that Deloitte charged on average £775,000 a year as Carillion's internal auditor since 2010, and name Michael Jones as the Deloitte partner responsible for Carillion's internal audit. Deloitte had other roles. Carillion's 2014 remuneration report states that Deloitte, appointed by the remuneration committee in 2005, advised the committee for time-based fees of £29,520 for 2014 (2013: £20,025), and also provided certain specialist consultancy services and internal audit resource but otherwise had no other connections with the group. The committees reported that Deloitte also offered due diligence on the 2011 takeover of Eaga and then received £730k for a subsequent transformation programme there, and that over the previous decade the 'Big Four' firms collectively received £51.2 million for services to Carillion. ^{1 2 3 4}

analysisThe committees reported that Deloitte, as internal auditor, rarely identified issues as high priority, only 15 of 309 recommendations between 2012 and 2016, and that across 61 internal audit reports in 2015 and 2016 only a single report, in 2016, found inadequate controls. In an assessment that is not a regulatory finding, they concluded that Deloitte 'were either unable to identify effectively to the board the risks associated with their business practices, unwilling to do so, or too readily ignored them'. Andrew Dougal wrote that he was generally happy with the quality of Deloitte's internal audit work, which he believed was undertaken thoroughly and with a high level of professionalism, that the audit committee's annual evaluations were positive, and that he had no reason to believe Deloitte was aware of the management and financial control issues that came to light in 2017; in mid-2017 he proposed extending internal audit's scope to the identification of negative accruals and the use of peer review information. Deloitte told the committees that it had no responsibility for preparing or auditing the 2016 financial statements. Responding to the report, Deloitte wrote that with regard to internal audit 'there are undoubtedly areas to reflect upon following the Carillion experience', noted that internal audit in the corporate sector is not a statutory requirement, and proposed a debate on whether the Corporate Governance Code should further clarify the role of internal audit and the audit committee's reporting obligations. ^{2 5 6 7}