Deloitte Fined £6.05 Million Over Audit Failures at Go-Ahead Group

Key Takeaways

• Deloitte Fined £6.05 Million: The FRC sanctioned Deloitte for numerous auditing failures involving Go-Ahead Group's financial statements from 2016 through 2020.
• More Than £30 Million in Public Money Retained: Deloitte failed to adequately challenge two Go-Ahead rail subsidiaries that wrongfully retained funds owed to the UK Department for Transport.
• Professional Skepticism Found Lacking: The regulator identified failures to investigate questionable accounting practices and properly evaluate evidence indicating fraud risk factors.
• German Rail Losses Understated: Deloitte's audit failures also concerned Go-Ahead's German subsidiary, where a provision for expected contract losses was subsequently increased from €8.1 million to €49.5 million.
• Additional Sanctions Imposed: Deloitte received a severe reprimand and must report on the causes of its audit failures, corrective measures and evidence of their effectiveness.

Deep Dive

The UK's Financial Reporting Council (FRC) has fined Deloitte £6.05 million for failures in its audits of Go-Ahead Group, including inadequate scrutiny of two rail subsidiaries that retained more than £30 million in public money owed to the Department for Transport (DfT).

This follow an investigation into Deloitte's audits of the transport company's consolidated financial statements from 2016 through 2020. The regulator identified numerous breaches of auditing requirements, some spanning all five years, involving matters Deloitte had already classified as significant audit risks.

Deloitte's original £11 million penalty was reduced to £6.05 million following discounts for exceptional cooperation, admissions and early resolution. The firm also received a severe reprimand, while the FRC declared that its audit reports for all five years had failed to meet the relevant requirements.

The findings concern three Go-Ahead subsidiaries operating passenger rail services in Britain and Germany. At two of them, money owed to the British government was retained without the DfT's knowledge. At the third, Deloitte failed to obtain sufficient assurance over accounting provisions for expected losses on rail contracts.

The problems at London & South Eastern Railway Ltd (LSER) began before Deloitte was appointed as Go-Ahead's auditor. The subsidiary had received erroneous overpayments under a rail franchise agreement and was required to repay them. Instead, it retained the money, recorded accruals for the amounts and began releasing those accruals into profit without notifying the DfT. The practice continued under Deloitte's audits. LSER released £2.4 million in overpayments into profit in the 2016 financial year and accrued a further £27 million between 2016 and 2020 under a subsequent franchise agreement.

Evidence obtained from management during the later audit years suggested that LSER intended to release the additional overpayments into profit if the department failed to discover them. In 2019 and 2020, the subsidiary also classified the accruals in its financial statements in a manner that concealed their true nature.

The franchise agreements required LSER to act in good faith, an obligation the FRC found the company had breached. Deloitte, however, failed to appreciate the significance of that requirement, including LSER's obligation to inform the DfT of the overpayments. The department discovered the conduct in 2021. It subsequently declined to renew LSER's franchise when it expired, sought to recover the overpayments and imposed a £23.5 million financial penalty.

Another Go-Ahead subsidiary, London & Birmingham Railway Ltd, had also retained money owed to the DfT without the department's knowledge. After its franchise ended in 2020, the company released £5.6 million in previously recorded accruals into profit and attempted to conceal the transaction through the wording of a note in its financial statements.

The FRC found that Deloitte had failed to make sufficient inquiries into the conduct of both subsidiaries, exercise adequate professional skepticism or properly evaluate evidence indicating the existence of fraud risk factors.

Both cases involved the wrongful retention of more than £30 million in public money over an extended period. Deloitte had failed to challenge that conduct adequately despite its responsibilities as the group's statutory auditor. The investigation also examined Deloitte's work on Go-Ahead Bayern GmbH, the group's German rail subsidiary, where questions arose over the expected profitability of its franchise contracts.

During the 2020 audit, Go-Ahead initially supplied information indicating that the contracts would be loss-making. The German component audit team concluded that the group needed to recognize an onerous contract provision in its financial statements. Go-Ahead subsequently provided revised information that changed the projected future cash flows from a loss of €8 million to a positive value of €3 million.

Deloitte failed to scrutinize sufficiently the evidence and explanations offered to support the revised assessment. Although Go-Ahead ultimately recognized an €8.1 million provision in its 2020 accounts, the FRC found that Deloitte had exercised insufficient oversight of the German audit team and failed to evaluate whether adequate audit evidence supported the provision.

In its 2021 financial statements, Go-Ahead restated the 2020 provision from €8.1 million to €49.5 million, an increase of €41.4 million. The regulator found that the amounts involved in the breaches across all three subsidiaries were material, either to the individual businesses or to Go-Ahead as a whole. Some of the failures persisted across five consecutive audits.

"These breaches show a highly concerning pattern of failure by Deloitte to apply sufficient scrutiny to decisions and actions by GAG which were clearly questionable," said Penrose Foss, the FRC's Executive Counsel and Executive Director of Investigations and Enforcement. "The fact that some of those decisions and actions put very large amounts of UK taxpayers' money at risk is particularly troubling, and this is reflected in the high level of financial sanction imposed."

In addition to the financial penalty and reprimand, Deloitte must submit a report to its FRC Firm Supervisor setting out its analysis of the root causes of the breaches, the remedial measures taken and an assessment supported by empirical evidence of how those measures reduce the risk of similar failures. The firm has also paid the costs of the investigation.

The FRC initially included Deloitte's audit of Go-Ahead's 2021 financial statements in its investigation. That portion was closed in December 2024 after Executive Counsel reviewed the evidence and decided not to pursue enforcement action.

The GRC Report is your premier destination for the latest in governance, risk, and compliance news. As your reliable source for comprehensive coverage, we ensure you stay informed and ready to navigate the dynamic landscape of GRC. Beyond being a news source, the GRC Report represents a thriving community of professionals who, like you, are dedicated to GRC excellence. Explore our insightful articles and breaking news, and actively participate in the conversation to enhance your GRC journey.