In addition to the fines, the PCAOB is requiring each of the KPMG firms to review and improve as necessary their quality control policies and procedures. It has also barred or suspended four auditors from participating in public company audits.
“These actions should send the message to KPMG and all other registered firms that the PCAOB is committed to rooting out misconduct wherever it occurs and will employ all sanctions at its disposal to protect investors and improve audit quality,” said PCAOB Chair Erica Williams.
“The breadth of the misconduct uncovered in these matters and the aggregate size of the sanctions imposed demonstrate the global reach of the PCAOB’s oversight and the Board’s heightened vigilance in enforcement,” said Mark Adler, PCAOB Acting Director of Enforcement and Investigations.
KPMG Colombia
As part of its firmwide enforcement sweep, the PCAOB censured KPMG Colombia, imposed a $4 million civil penalty, and also required the firm to undertake certain remedial measures concerning its system of quality control. In addition, the firm will be required to complete a further investigation under the supervision of an independent consultant to determine the extent of exam cheating among the firm’s personnel and to recommend appropriate remedial actions.
The PCAOB additionally sanctioned three individuals—José Daniel Meléndez Giménez, Edgar Mauricio Ramírez Rueda (Ramírez), and Marco Alexander Rodríguez Ramírez (Rodríguez)— for violating PCAOB rules and standards in connection with the PCAOB’s 2016 inspection of the firm. The PCAOB also charged the firm with violating quality control standards relating to audit documentation and the firm’s internal training program.
According to the PCAOB, in 2016, the firm and various individuals improperly altered audit documentation for two audits in anticipation of a PCAOB inspection and provided that altered documentation to PCAOB inspectors. Meléndez, the engagement partner for one of those audits, directed the improper alterations for that audit, and Ramírez and Rodríguez participated in the misconduct.
“The noncooperation resulted, in part, from deficiencies in KPMG Colombia’s system of quality control, which failed to provide reasonable assurance that (1) audit documentation was protected against improper alteration and (2) appropriate control was maintained over administrative passwords that could be, and were, used to backdate changes to work papers,” the PCAOB said.
The PCAOB also found that, from at least 2016 to 2020, KPMG Colombia violated PCAOB quality control standards related to integrity and personnel management. Those quality control failures prevented the firm from identifying extensive, improper answer-sharing among firm personnel in connection with tests on internal training exams covering topics that were relevant to compliance with PCAOB rules and standards.
Meléndez, Ramírez, and Rodríguez have agreed to settlements that bar them from being associated with a registered public accounting firm. Meléndez will have the right to file a petition for Board consent to reassociate with a registered firm after three years, while Ramírez and Rodríguez will have the right to file a petition for Board consent to reassociate with a registered firm after two years and one year, respectively.
Meléndez will additionally pay a $25,000 civil money penalty, an amount that was reduced after considering his financial resources, the PCAOB said. Ramírez and Rodríguez would have paid penalties, but they were waived after also considering their financial resources. KPMG Columbia, Meléndez, Ramírez, and Rodríguez admitted to the violations involving the failure to cooperate with the PCAOB’s 2016 inspection and the improper alteration of documents.
KPMG U.K.
In a second action, the PCAOB issued two disciplinary orders against KPMG UK. In one order, the PCAOB sanctioned KPMG UK for violating PCAOB quality control standards related to integrity and personnel management. Like KPMG Colombia, KPMG UK “failed to detect or prevent extensive, improper answer sharing on tests for mandatory internal training courses,” the PCAOB said.
“From 2018 until March 2021, hundreds of individuals from KPMG UK and KPMG Resource Centre Private Limited, an India-based entity that provides support for KPMG UK’s issuer audit work, engaged in improper answer sharing…in connection with tests for training courses covering topics that included auditing, accounting, and professional independence,” the PCAOB said. “All of the professionals implicated in the answer sharing performed work for KPMG UK’s assurance practice.”
Without admitting or denying the findings, KPMG UK was censured, issued a $2 million civil money penalty, and must review and improve as necessary its quality control policies and procedures “to provide reasonable assurance that its personnel act with integrity in connection with internal training.”
In the second order, the PCAOB sanctioned KPMG UK for failing to reasonably supervise an unregistered Romanian audit firm, KPMG Audit SRL, in four consecutive audits of a public company client, in which it incurred as many as 74 percent of the total audit hours. “Compounding the failure, in three of the four audits, KPMG UK erroneously reported that PCAOB-registered firm KPMG Romania SRL, not KPMG Audit SRL, had participated in the audits,” the PCAOB said.
Additionally, the PCAOB found KPMG UK to have violated, in connection with the same four audits, PCAOB standards relating to due professional care, audit planning, audit committee communications, and quality control. The Board also found that the firm had made several inaccurate filings on PCAOB Form AP regarding other audit clients, disclosing that registered KPMG affiliates had participated in various audits, when in fact separate, unregistered firms had done the work. The firm has since corrected the Form APs at issue and agreed to review and improve its quality control policies and procedures as necessary, the PCAOB said.
Without admitting or denying the findings in the second order, KPMG UK consented to the PCAOB’s order and the disciplinary action. The PCAOB imposed a $600,000 civil money penalty, censure, and quality control undertakings.
KPMG India
The PCAOB also sanctioned KPMG Assurance and Consulting Services (KPMG India) and KPMG India engagement partner Sagar Pravin Lakhani. The sanctions are the result of quality control failures by KPMG India and Lakhani’s supervisory and documentation failures in connection with a practice of signing off on blank placeholder work papers during the 2017 audit of a public company.
The PCAOB found that, in the course of that audit, Lakhani and other members of the KPMG India engagement team signed off on dozens of blank work papers. The blank work papers were replaced with completed work papers, in many cases after the issuance of the audit report, but the sign off dates were not updated.
“As a result of this practice, the work papers did not appropriately reflect the dates on which the audit work was actually completed and reviewed. KPMG India was aware that its audit software allowed personnel to modify or update audit documentation without modifying the sign off date,” the PCAOB said.
By signing off on blank work papers and failing to appropriately supervise engagement team members who he knew were doing the same, Lakhani violated PCAOB documentation and supervision standards and failed to act with due professional care. In addition, KPMG India violated PCAOB quality control standards because its policies and procedures failed to provide adequate assurance that its personnel would document audit work in compliance with PCAOB standards.
In that action, the PCAOB censured KPMG India, imposed a $1 million civil money penalty, and ordered the firm to review and improve as necessary its quality control policies and procedures. The PCAOB also imposed a $75,000 civil money penalty on Lakhani, censured him, and suspended him from associating with a registered public accounting firm for one year. 
Jaclyn Jaeger is a contributing editor at Compliance Chief 360° and a freelance business writer based in Manchester, New Hampshire.