EY gets banned from new audit business in Germany

Lets face it, the answer from chatGPT would be almost identical to what these consultants say, however the main reason for consultants is to CYA so if the decision is bad, you can blame someone else.

Ex accenture here, left and started my own. M u c h better and my clients love that I am not from a big shop. Money is good and life is smiling.

Part of the grift is that roughly one of ten of these unproven low-paid MBAs will be exceptional. So when one does a good job they'll use it as an example of typical performance. I see this happen with dev talent agencies and unproven software engineers. Only the great projects go in their portfolio and the satisfied clients are happy to appear on their website because they don't realize they just got lucky.

With software engineers some of the remaining 90% really are talented but spend most of the project learning on the job, fixing an issue in a few hours that a senior engineer in their stack could fix in 30 minutes with their arcane knowledge. Meanwhile the senior engineer goes to the scrums (they love to hide behind agile). It's a solid grift.

Does outsourcing major strategic initiatives even work? Seems like the definition of the sort of things you shouldn't outsource

Interesting, but how does your experience relate to the linked story? Is EY somehow related to Accenture? Are Accenture also doing auditing?

On the consulting side of the audit firms that you're talking about, I think people misunderstand why companies hire big consultancies.

It is not for performance.

It's for minimizing risk.

And not "risk that the project will fail to hit its schedule." Rather "risk that the company is unable to deliver the thing we're asking for at all."

When I've seen big consultancies fail, it almost always goes like this: (1) big idea sold with A-team, (2) contract won and lowest-cost B-team substituted in, (3) B-team screws up execution, and customer usually figures out on or right before target delivery date, (4) if smart, customer tears consultancy a new asshole, from people with VP et al. titles, (5) if interested in further business then consultancy profusely apologies and puts an A-team back on the project, (6) A-team delivers, albeit after schedule.

The difference between ey et al. vs smaller shops is (4). Smaller shops don't have extra senior bodies laying around to retask.

So a more accurate description of a VP hiring ey is probably "I know they're going to screw it up, but I know if I bitch enough they'll eventually get it done right."

Big 4 is a multiway confidence trick at this point, scamming employees, clients and governments all at once.

It’s true.

I work as a Client Partner for a $1B+ consulting firm that comes in and cleans up after these situations. We bring in seasoned, experienced consultants with the functional knowledge that these big consulting firms don’t have. And even though our consultants are more costly on a per head basis, we’re more cost effective overall, because we do more with less.

I always admired the big consulting firms until I realized how consistently they fail to deliver. It’s hard for the clients to fix it because they genuinely think they are getting the best. It’s sad and laughable. Eventually they figure it out. Usually when a firm like us comes in and exposes the dysfunction by getting a few consultants in there that know what they are doing and running things like it should. And it generally comes down to a lack of leadership— by both the client and the big consulting firm. They point the finger at each other. But also it’s just a lack of experience by those running/implementing the program. Staffed by consultants who read all the books and go to the trainings and classes but have never been in industry and been in the clients shoes.

It's a form of corruption. In China, they take 10% of the top, in Africa the money dissapears, in the West, consultants take 80% and it's all legal.

> Well ok, but was EY less competent than McKinsey or did they just get unlucky that they're the poor bastards who stepped on the landmine?

I have asked myself the same question, before I noticed that EY is basically the Credit Suisse and the SoftBank of the audit world[1]:

> EY has been involved in many accounting scandals: Bank of Credit and Commerce International (1991), Informix Corporation (1996), Sybase (1997), Cendant (1998), One.Tel (2001), AOL (2002), HealthSouth Corporation (2003), Chiquita Brands International (2004), Lehman Brothers (2010), Sino-Forest Corporation (2011), Olympus Corporation (2011), Stagecoach Group (2017), Wirecard (2020), Luckin Coffee (2020) and NMC Health (2020).

In fact, Wirecard managed to partner with EY, Credit Suisse, and SoftBank simultaneously just before going bankrupt.

Maybe because no reputable companies wanted to touch it?

[1] https://en.wikipedia.org/wiki/Ernst_%26_Young#Accounting_sca...

The auditing arm of EY is in a completely different industry than McK and similar firms.

That EY's auditing track record is, well, checkered is a different problem. By throwing those two into the same bucket, so, shows some lack of understanding of auditing, accounting and consulting. EY also does, sometimes legally required "consulting" work for in the accounting space. That work is completely different from stragoc management consulting ala McK and BCG. And it also a different beast than the lower level outsourcing consulting ala Accenture.

> The auditor has a responsibility to plan and perform the audit to obtain reasonable assurance about whether the financial statements are free of material misstatement, whether caused by error or fraud.1 Because of the nature of audit evidence and the characteristics of fraud, the auditor is able to obtain reasonable, but not absolute, assurance that material misstatements are detected.2

https://pcaobus.org/oversight/standards/auditing-standards/d...

What never made any sense to me was the incentives. Is the company supposed to hire people to write a public report saying the company committed fraud? It doesn't really seem like it makes sense for anyone. If anything, you'd just do some minimal performative work to say you had a good look in the company, and then you pick up more work next year. If you write a critical report, how many companies will want to hire you? I'll pick the easy going auditor who doesn't give me a hard time, thanks.

Contrast that with say an HMRC tax audit. They're not there to be your friend and it actually makes sense for them to investigate certain firms.

It would be interesting to read a history of the industry to see how we ended up here.

> Auditors seem mainly to just double check the numbers they're handed. This serves a purpose, it provides some level of guarantee that companies that are acting in good faith are generally reporting correct numbers. Auditors don't do what people seem to think they should do - investigate and uncover fraud. If a company wants to commit fraud, the auditors simply aren't resourced in a way that would allow them to uncover it because there's not really that much incentive to uncover the fraud, the fraudster is extremely motivated, and if you wanted that level of hostile investigative work it would be much more expensive for every company.

While I agree audit is a hard job auditors should not just rubber stamp what the company gives them. They should ask probing questions like "where did this sale come from?", "how did you calculate this figure?" and "why are you doing this? It is unusual." A consequence of this is that they may pick up on suspicious signs within a set of accounts and choose not to sign them off, but I wouldn't say theeir job is to identify fraud per se.

What is clear from cases such as wirecard is that EY have failed to ask these probing questions on several occasions, and subsequent audits (by other firms) have shown it is entirely possible to ask appropriate questions and uncover dodgy practices.

1) auditors do uncover errors. sometimes those errors leaad to firings and restatements. An entire company does not need to be complicit with fraud, for there to be fraud. key employees commit fraud to enrich themselves or make their numbers look better. from that perspective, the board does benefit from existing audits.

Also audit is highly regulated. If the standards are too loose the PCAOB can come in and punish you severely.

Its the pervasive cases, the wirecards, that are hard. Those are the frauds that are pervasive and go to the top, and include auditors that are not pushing back. These are the true landmines.

How are they addressed? Many ways: A) There is a layer of prevention, where audit firms will force rotation of their lead audit partners on an audit every 2-3 years to prevent cozy relationships.

B) And theres Also the "audit the auditor" where another partner has the sole job of reviewing the work done. He's the landmine hound looking for explosives.

2) the insurance business actually rakes in profits typically after a large disaster, when premiums are sky high and customers are are hyper aware of the risks (and Boards unforgiving with CEOs that fail to mitigate the risks.

if only this were limited to ethics and compliance.

expertise is a virtue in modern society. signaling it well is often easier and more successful than developing and maintaining it.

damn lucrative, too.

this is why we can’t have nice things.

"Cheating on ethics exam" sounds bad but it amounts to not taking some boring corporate CYA compliance training seriously, it's not actually unethical in my opinion. If anything it speaks to how bad corporate training is generally, not the ethics of the people "cheating".

They cheated on the ethics exam, THEN they lied about their cheating.

As well as a €500K fine, five employees were also fined between €23,000 and €300,000. And seven others escaped punishment by handing back their auditor’s licences.

I’m not sure many reputable public companies will be queuing up to use their services in 2 years time

It would be an interesting idea to make auditors fully accountable like bankruptcy advisors. I know, this is never going to happen.

Really? 5 years? That seems really harsh. Is it all business failures or does it have to be due to mismanagement? I've heard the climate is very hostile to businesses in Germany; my sister in law was trying to sell art on etsy and apparently she had to get a business license to do so in Germany. She's now back in the USA where she can just sell stuff online and the only thing she needs to do is file her taxes correctly

So as a super talented CEO, would you take any jobs trying to save a failing company?

>>Is there anyone here who can give an example of something fraudulent that is hard to catch?

Someone in control of the checkbook at a medical facility who starts a shell company with some innocuous sounding name (i.e. Smith's Medical Supply) and and regularly submits bills in low enough amounts that they don't raise concerns - which of course is relative to the size of the company - but say you run a practice that has $50M in annual revenues, it would be quite easy to send in bills for supplies that only amount to 1-2K per invoice over a long period of time.

This kind of thing happens a lot, and without actually contacting every single vendor, verifying they are real, and verifying every thing that was purchased, can be very difficult to root out - especially with supplies that get used up, as opposed to hard assets they are supposed to be around for a while.

When the numbers are small enough, nobody even bothers to verify them - even though over years they can add up to a significant amount of losses.

I hear about stories like this all the time - it is pretty common.

Auditors have access to all the financials, but they only audit a statistically significant sample, because it would be incredibly expensive to audit every transaction.

Fraud can be easily detected if one employee is committing it. Fraud is substantially harder to find if two employees are involved, specifically 2 employees involved in internal controls.

For instance, if you have a policy that all checks paid over $10k require 2 signatures from corporate officers, it’s easy to catch a check with one officer forging the name of a second in order to siphon money to his 3rd party shell company.

But if both officers make a shell company, they can post the check as usual, and the check would pass auditor checks unless they looked into the specific corporation being paid, which may be out of scope if it’s a relatively small transaction.

Ultimately, you don’t need assurance that the financials don’t have fraud, you want assurance that they’re materially correct. Whether the company lost 10k to fraud or waste or incompetence is almost irrelevant for the investor, because the company has 10k less money. Obviously they’d prefer it not be due to fraud, but the impact on the financials is more or less the same.

Source: am a CPA

Plenty of things aren't necessarily evidences. Just because you have access to account statements telling you you got a bunch of money coming in from person X for provision of service Y and a matching contract doesn't mean that the contract has been fulfilled or that the service was worth the money.

Same with picking a supplier - there are processes in place that try to assess quality, speed, price, effort, etc, but in the end it's humans making decisions, humans with bias and the ability to lie and make untrue statements as to how they made their decision.

Then there are the usual money laundering techniques, eg art dealing. You could easily spend a few million $$ on art for, say, a big office. And the VP's niece might be an artist that can demand that on the open market.

It’s hard to grasp how complex accounting can be for companies. EY is not auditing small businesses, these are large multinational companies and per audit guidelines they likely just audit random samples of accounts. It’s not as simple as let’s pull a listing of all bank accounts and make sure everything ties. The actual effectiveness of audits is a different conversation.

Don't know much either, but I found this Money Stuff story interesting: https://www.bloomberg.com/opinion/articles/2023-01-04/privat...

Someone was CFO at two companies and the auditors only checked the year end balance against his falsified statements. So he transferred money from the other company temporarily to make them match.

"""To avoid detection, Morgenthau doctored African Gold’s monthly bank statements by, for example, deleting his unauthorized transactions and overstating the available account balance in any given month by as much as $1.19 million. [...]

Morgenthau knew that African Gold’s auditor would confirm directly with the bank the actual account balance as of December 31, 2021, as a part of its year-end audit. [...]

Morgenthau deposited more than half a million dollars of Strategic Metals’ funds into African Gold’s bank account on December 31, 2021, because he knew that African Gold’s auditor would confirm the account balance as of that date, in connection with African Gold’s year-end audit. """

https://www.sec.gov/litigation/complaints/2023/comp-pr2023-1...

> Or can the numbers all add up but there's still fraud?

Yes, of course. Consider that you've set up a separate company and you intend to steal money from your employer. You've got a buddy in accounts payable that you're in cahoots with. You get set up as a vendor, you send invoices to the company, they pay them, and you never deliver anything. The company's numbers add up. They pay vendors for services all the time. Whether the vendors are real, the contracts are legitimate, and the expected services were provided isn't on the account statements.

Just because you have access to the entire source code of Linux kernel, doesn't mean you'll be able to find all the bugs in it. Sometimes the numbers may add-up but it is the patterns which may be suspicious. Automation like sanity checks/pattern matching etc (+ ML now a days) would help a great deal but even then it is not a guarantee.

So, Wirecard claimed to make huge profits. Now, the auditors would expect to see a pile of cash in the accounts. However, Wirecard claimed to expand rapidly by purchasing other companies in Asia. Those, then, booked most of the "profits" and were the assets on the book. Wirecard produced bank statements from the Philippines claiming that they had $2bn cash sitting there. So, to the auditor, the numbers added up, and the whole story was somewhat coherent. It's just that the foreign businesses and that cash didn't actually exist.

There are different types of audit.

I expect that EY does not have access to numbers and any account information. You give away as least information as you can because you cannot just trust auditing team from some 3rd party not to use that data in collusion with your competitors.

What I expect they do have access to is documentation for procedures and processes. They audit for example if all procedures are written down and check proofs for procedures that were done by employees.

So it is like you have to clean the toilet and you have procedure that whoever cleans the toilet signs list. Every end of the shift manager checks the list and checks toilet if it is clean.

Fun part is having signed list for a day does not tell you that for half of the shift employee was only signing the list but did not do any cleaning and you might have dozens of customers seeing how terrible dirty toilet was.

> Is it just a top-level glance at the numbers because there isn't enough time/money to scrutinize everything?

This seems to be the case for our EY IT audits anyway. Just send them the right screenshots and all the boxes will be ticked.

   > As someone who knows nothing about this area, I don't understand why audits won't always detect fraud.

as some one who studied accounting and auditing, here is a page from my text:

https://kfknowledgebank.kaplan.co.uk/audit-and-assurance/aud...

but the tl;dr is that auditors don't provide "insurance", they provide "assurance", specifically reasonable assurance.... that the accounts are "true and fair"

or to be put it in even simpler terms, they can't guarantee something fishy did or didn't happen, the transaction scope is just too much, they will "try their best" and do enough of a check to say if anything fishy pops put.

    > Is it just a top-level glance at the numbers because there isn't enough time/money to scrutinize everything?

yes you hit the nail right on the head. Of course things have changed, govt have put their own requirements in addition to auditing standards, but still that's an adequate summary.

the more through of a check, the more difficult, time consuming and expensive it becomes, and at some point the fraud becomes cheaper than the audit.

but even more importantly is the mentality. There is a phrase we were taught "Auditor is a watchdog and not a bloodhound" that kind of explains what auditors are supposed to do.

----

i left the field but i'll try to answer to the best of my ability

"Exposure: Inside the Olympus scandal: How I Went from CEO to Whistleblower" is a great book that is in part about fraud by mergers and acquisitions.

Most of the others replying here are generally saying fraud is missed because it's complicated; however, in my opinion, it's because the auditors don't know anything else other than "do the numbers add up". Once the numbers do add up, they stop there.

The vast majority of auditors are only 3 year or less years out of school. They don't even know how a corporation is run at that point, so how are they supposed to catch anything suspicious.

All audits should be disclosed in giant black letter on the front “PAID FOR BY THE AUDITED COMPANY”

The conflict of interest in external audit is absurd. It’s similar to securities rated rating agencies paid to rate the instruments by the issuing company.

I once worked at a small pen-testing firm that also conducted PCI DSS compliance tests, and I can confirm that this is an accurate depiction of the industry. A majority of the staff were recent grads, and it was disheartening to see that most clients were primarily interested in obtaining the compliance certification rather than genuinely improving their product security. This, in turn, creates a perverse incentive for auditors to grant compliance, as clients who don't get the desired outcome may simply switch to a different auditor. In such a setup, it's difficult to ensure that security standards are genuinely upheld. On a positive note, these compliance tests do help in making sure that card data isn't stored in plaintext, but beyond that, the overall impact on security seems rather limited.

> From business perspective the auditors are clueless.

Hey! I used to be a young IT grad helping with financial audits.

If it helps, I was young and clueless and frequently I still figured out more about the business processes I was auditing than the client employees taking care of them every day :-p

I worked at a company that had to deal with EY as a part of a tech certification. Tha auditors barely knew why they were being sent over. Out managers and techs had to explain the process to them and assure them the numbers in the report were correct. The auditors happily accepted that, and then charged around 100k. Top job.

If they do, they'll be tempted to rat out the political overlords who dictated the "see no evil, hear no evil" policy.

The head of BaFin and their deputy were forced out over it and the agency is undergoing significant restructuring[1], and a new agency was formed specifically for investigating financial crimes[2].

In terms of actual liability - no, at least not yet. A number of lawsuits by individual investors were thrown out[3] but it's possible there will be public prosecution:

> Criminal prosecutors in Frankfurt are assessing whether BaFin employees obstructed justice by not properly investigating fraud warnings.

In the end, it's a regulator, they have to rely on auditors to some point. If Wirecard lies and EY doesn't catch it, that's on the criminal and the auditor. Still, it's hard to understate just how badly the agency fucked this one up... Hopefully, it'll serve as a true wake-up call.

Certainly seems like it - they have been more aggressive recently with other problem companies like N26, Solaris Bank, Coinbase, Deutsche and others.

[1]: https://www.ft.com/content/4f948457-678e-485c-92f7-2837064a5...

[2]: https://www.ft.com/content/587b6c52-c93e-4b2c-949a-53f6a1667...

[3]: https://www.ft.com/content/9fab6842-4ee6-4114-a35c-09bf9c62a...

BaFin's role in this is indeed pretty astonishing:

"The German financial watchdog has filed a criminal complaint against two Financial Times journalists and several short sellers, accusing them of potential market manipulation over reports about suspected accounting irregularities at payments processor Wirecard."

https://www.ft.com/content/8e1948be-6060-11e9-b285-3acd5d435...

That's part of the issue. Another big part is that we should put a whole load more money into investigating financial crime (so funding white collar crime investigatory units as well as tax authorities).

As a publicly traded company, you have to hire auditors. If you don’t like EY you can go to PwC, KPMG or Deloitte, but what’s the difference?

Well I bet wirecard did trust them to help them to commit fraud.

Agree about the proxy part for the consultancy business, it should be common knowledge and those manager should be fired

This article is about auditing, your comments appear to be about consulting / advisory businesses.

Otherwise, I mostly agree, though I don't support a ban. It's a complex topic - companies are free to waste money how they want, and even governments do need real advice. It's just too bad they pick such shitty advisors to support decisions they've already made instead of actually seeking good advice.

They are "professional scapegoats" IMO, companies pay them to take the blame and their business model seems to be: collect fees, do an "audit", pay the fine, keep the spread.

Well, EY didn't get banned from consulting, but rather accounting work. And the latter is crucial, and even legally required for all and every public company. The reasons are, among others, Enron and , yes, Wirecard. And the fact that EY screwed up Wirecard is the reason they got banned.

By the way, it was KPMG that caught the Wirecard fraud. And KPMG is in the same league and business as EY.

One of the reasons, IMHO, that Wirecard managed to get away with it for so long is, that as a German company, they didn't have to switch Accountants and have another accounting firm helping them in preparing the books. That would be a SOX set-up, and it makes perfect sense. It helps to prevent fraud and it protects retail investors, both of which are good things in my book.

Strategy consulting, the stuff BCG and McK does, is different. As is the outsourcing and consulting Accebture does, which is also different from what McK does. The topic so, is EY and accounting.

McKinsey and BCG do not audit companies. They are consultancies and do not certify accounts to be “correct and legit”. Think of auditing companies a little bit like of vehicle inspection shops certifying your car is safe for the road.

Consultancies are not doing that.

I’m not sure why certain businesses should be “banned” because YOU believe they do not add value. Do you pay them? No.

It’s not correct that they are proxies for decision making that mangers don’t want to be responsible for. Neither McK nor BCG could run at the scale they do for five decades if that was the case.

But I suppose that was just your happy Sunday rant of the day to let off some steam.

The big four prop up the business world, status quo.

Say your a large company listed on the stock market, so pick from the four big companies because serious companies use them, who's the CFO an ex-account from the big four who knows their orderand process.

Now if no other companies can enter that bubble, are we really surprised at the outcome!?

My partner works at one of these big four companies and the way she puts it - they essentially function as outsourced expertise for governments the world over - essentially expert functions have been hollowed out of state governments and into the private sector and thus there is really no expertise within the national government level to handle complex tax and accounting situations and they are instead all outsourced to these firms.

We should really consider the present western world as some sort of marriage of corporatism and government - they are really hand in hand as two sides of the same coin.

What is "skin in the game" in this context?

>They are mainly used as proxies to make decisions managers dont want to be responsible for.

Interesting I just watched a video [1] on consulting yday. It is on something similar happening in the UK. And another video ( couldn't find it ) that suggest unless there are some other interest for these consultant, ( like outsourcing certain function to certain clients ) all they do is to make a case for what the management wanted to do anyway, and rubber stamp on it. And mostly because management wanted something on their CV / resume, so they could move on to another job and repeat the same process again.

[1] https://www.youtube.com/watch?v=Aj2od-Jpanw

Er… McKinsey and BCG don’t even do audit. What do they have to do with TFA?