Inside the audit lapses that led to IL&FS

crisis

Mumbai: Every time there is corporate scam, audit firms and auditors are the first ones to be
blamed. This time, too, after the Infrastructure Leasing and Financial Services Ltd (IL&FS)
crisis, the auditors, especially the “big three"—EY, Deloitte and KPMG—are in the dock.
Yet, larger questions remain about the changing role of the Institute of Chartered Accountants
of India (ICAI), besides India’s auditing rules.

As things stand, IL&FS and its vast network of subsidiaries has now become a PR nightmare
for the big three.

Last September, IL&FS had defaulted on its debt obligations, triggering a liquidity crisis in
the financial services market. IL&FS and its subsidiaries owe ₹99,354 crore. The government
was swift to act and replaced the IL&FS board with hand-picked nominees in October.
Subsequently, protracted rounds of investigation by agencies, a forensic audit, the board’s
own research and analysis to understand the depth of the rot, and the government’s recourse
to the legal route to resolve the crisis followed.

The affiliates of Deloitte Haskin and Sells Llc, KPMG India, and EY India Ltd were auditors
of IL&FS and its subsidiaries—IL&FS Financial Services Ltd (IFIN) and IL&FS
Transportation Networks Ltd (ITNL). Probe agencies, including the Serious Fraud
Investigative Office (SFIO) and National Financial Regulatory Authority (NFRA), are also
probing the role of auditors.

In a recent interview, ministry of corporate affairs (MCA) secretary Injeti Srinivas said the
auditors have a lot to answer for: “We are not expecting an auditor to detect a needle in a
haystack, but if an elephant is in a room, they ought to find it."

Separately, the ICAI, the accounting regulator, initiated action against a KPMG affiliate, BSR
and Co. Llp, for professional misconduct under the Chartered Accountants Act, 1949.
“Professional or other misconduct" is described as an act of omission by auditors, whose job
is to provide a true picture of a company’s accounts. According to the ICAI, the auditors did
not highlight the Reserve Bank of India’s (RBI’s) inspection report, which had labelled IFIN
as over-leveraged, besides failing to report negative cash flows and adverse key financial
ratios. A copy of the notice was reviewed by Mint.

BSR approached the Delhi high court even before the ICAI could start proceedings, and the
court stayed the order on 25 February on the ground that the ICAI had relied on media reports
and did not possess any findings of its own.

The protracted legal battles and the charges of fraud (former IL&FS vice-chairman Hari
Sankaran was arrested in April) show the wide-ranging magnitude of the fallout. Can external
auditors really be trusted to tell the truth about a company if they are also angling for
consultancy work from the same entity? Can a corporate behemoth, which has hundreds of
group entities, be trusted to not hide shady transactions in its subsidiaries? Can existing
regulations be trusted to catch up with an erring company before the problem blows a ₹1
trillion hole in the economy? Well, essentially, the question in the aftermath of the IL&FS
crisis is all about trust—concerning auditors and regulators, as well as the corporate entity.

History Forgotten

Our regulators and enforcement agencies don’t seem to learn from history. It was not so long
ago – January 2009 – when Satyam Computer Services boss B Ramalinga Raju was taken
into custody after he manipulated accounts to show excess revenues of over Rs 14,000 crore.
It was also revealed that auditors PricewaterhouseCoopers (PwC) were complicit in this huge
cover-up.

It took the Securities & Exchange Board of India (SEBI) nine long years to complete
investigations and penalise PwC. The final verdict, given in January 2018, was a let-down: a
ban on PwC from providing audit services to listed companies for two years and a
“disgorgement” of `13 crore.

EVIDENCE PILES UP

In the current IL&FS case, the Serious Fraud Investigation Office has found that in the main
IL&FS subsidiaries — IL&FS Financial Services (IFIN), IL&FS Transportation Networks
Limited (ITNL) and IL&FS Securities Services Ltd (ISSL) — the basic principles of auditing
were given the go by Deloitte though it charged a handsome audit fee of Rs 13-14 crore and an
additional `6-8 crore in advisory/consultancy fees.

IL&FS was incorporated in 1987 to promote infrastructure lending. Over the years, it grew into
a multi-layered behemoth with over 350 interconnected subsidiaries. By September 2018, the
crisis was triggered when IFIN defaulted on its repayments; and there were shock waves when
it was found that there may be unpaid loans to the tune of `91,000 crore. The old board has
been sacked and a new, government-mandated board headed by Uday Kotak is attempting to
put the pieces together.

Central to the current investigations now is the deposition of a whistle-blower, who claims he
was part of the senior IL&FS management team. He has alleged that it is not just Deloitte’s
failure of due diligence, but its abetment in the fraudulent practices. When audit findings did
not show IL&FS in ‘favourable light’, the auditor conveniently relied on ‘management
explanations and comfort letters’ and compromised its independent opinion. At times, IL&FS’
top echelons would meet and “coerce Deloitte for a more favourable position or watered down
position.” The fact is that Deloitte has, over a decade, never once provided an audit report with
adverse findings, even for 2017-18 when the loan crisis of IL&FS had ballooned
to unmanageable proportions.

IT HAPPENS IN THE US TOO

An auditor’s job is to assess a company’s financial information and determine if the

information is accurate and complete. What we have here is the auditor not only shielding
financial wrongdoing, but becoming complicit in the fraud. It does not only happen in India.
In case of the US energy major, Enron Corporation, it was found that the company had kept
huge debts off the balance sheet and ultimately collapsed in 2001, losing $74 billion of
shareholder wealth.

Audit firm Arthur Andersen, known as one of the ‘Big-Five’ was found guilty of having cooked
up the accounts and was forced to surrender its license to practice. Though it got a legal reprieve
later, Arthur Andersen went into oblivion. Back to IL&FS and India, the government wants to
impose severe penalties including a possible five-year ban on Deloitte.
However, if the process of investigation takes a decade, as it did for PricewaterhouseCoopers
in the Satyam case, the purpose of deterrent punishment will be defeated. Auditors are the eyes
and ears of the financial system. If they become part of the loot, the system will collapse. The
government has sweeping powers under Section 140 (5) of the Companies Act to force a
company to change its auditors if they are found to be engaged in or abetting fraud. It should
make use of it effectively. A ban for two-to-three years is not good enough. They should be
kept out for good.

There must have been smoke if there was a fire. The depth of the rot in IL&FS did not have to
hit `91,000 crore before it blew up. And didn’t anyone know Deloitte was covering up? As we
said, it doesn’t happen only in India. Fortune Magazine had named Enron as ‘America’s most
innovative company’ for six years in a row before the s—t hit the ceiling covering up According
to the whistle-blower, when audit findings did not show IL&FS in ‘favourable light’, the
auditor conveniently relied on “management explanations and comfort letters”.

If you can't change the rating, change the agency

As several instances of collusion between crisis-hit IL&FS and its credit rating agencies have
surfaced from the forensic audit of the lending group, the Grant Thornton report also shows
that at times when rating agencies informed the company about according low or negative
ratings, key IL&FS management personnel would approach other agencies in search of
desired ratings.

Approaching other agencies was among the various methods of receiving favourable rating
assessments apart from offering lavish favours in lieu of fake healthy ratings, urging the
rating announcement be delayed and keeping the rating in private domain.

In its report, Grant Thornton said that in an e-mail dated August 12, 2008, then IL&FS
Financial Services (IFIN) Joint Director Arun K. Saha said that ICRA committee had decided
to not issue "AAA" rating for the debt instruments of IFIN.

The report noted that ICRA's decision was "not agreeable" to then IFIN MD and CEO
Ramesh Bawa.
The e-mail trail suggests that the key employees of IL&FS used to approach other rating
agencies if they did not get the desired ratings, the audit report noted.

In a mail to Saha, with copies marked to then IL&FS Chairman Ravi Parthasarthy and Vice
Chairman Hari Sankaran among others, Bawa said: "I think, we should not compromise
accepting any lower rating than 'AAA' for IFIN", to which Saha said that they need to work
out among rating agencies.

Further, in the e-mail trail, Parthasarthy suggested that they can approach other agencies like
CARE, Fitch and Crisil for the ratings instead of ICRA.

Parthasarthy's mail to all the officials concerned said: "We don't have to go to ICRA at all.
For the time being, CARE and Fitch can be approached. I will also meet Ravimohan one of
these days and initiate a dialogue with Crisil."

In another instance, the management of group company IL&FS Transportation Networks Ltd
(ITNL) wanted to remove CARE as its rating agency on the grounds that it downgraded the
ratings of Jharkhand Road Projects Implementation Company Ltd (JRPICL) non-convertible
debentures by two notches, although India Ratings and Crisil had maintained their ratings at
AA(SO).

In an e-mail dated October 15, 2018 senior ITNL executive Madan Mohan requested the
removal of CARE as the rating agencies of JRPICL "since two rating agencies are sufficient
from a regulatory standpoint".

At times when they did not get favourable ratings, IL&FS officials pressurised the rating
agencies and said that the company may withdraw its rating request.

Grant Thornton's review also identified an e-mail dated July 16, 2009 where IL&FS official
K.V. Sawant informed Saha that he is in talks with Brickwork Ratings to obtain a rating from
them. In another mail, he noted that Brickwork was not ready to assign the desired "AAA"
rating to the non-convertible debentures worth ₹400 crore.
"I told him that, we may withdraw our rating request," Sawant said in a mail dated July 27,
2009 to Saha among others.

Questions to think about:

a. Should I L & FS For have relied on Delloit for independent audits while it was using
their advisory/consultancy services?
b. What possible gains can be had by having the same company provide the auditing and
consulting/advisory services?
c. Just like ratings agencies, companies often chose the auditing firm they want the audit
from. Would it be a good idea to randomly allocate auditing firms to company and
thereby take away the discretion in choice of auditors.
d. Would having multiple auditors do the audit solve the problem?
e. Who is the ‘Principal’ versus the ‘Agent’ in case of Auditing services?