EY was warned in 2016 by one of its own employees that senior managers at Wirecard may have committed fraud and one had attempted to bribe an auditor.
The revelation that an EY employee identified suspicious activity at Wirecard four years before the payments group imploded in Germany's largest postwar corporate fraud will increase the pressure on the accounting firm, which audited Wirecard for more than a decade and provided unqualified audits until 2018.
EY is already under investigation by Germany's auditor oversight body Apas and is the target of lawsuits from Wirecard investors who lost billions of euros when the company collapsed in June.
Last month, EY's global chairman Carmine Di Sibio wrote to clients to express "regret" that the fraud was "not uncovered sooner" but he claimed that EY was ultimately "successful in uncovering the fraud".
However, a KPMG probe found that an internal whistleblower at EY had raised fraud allegations against Wirecard in 2016 and also reported that the company had attempted to bribe an auditor in India.
EY then conducted an investigation, but this was shut down at the behest of Wirecard's second-in-command Jan Marsalek, who is now a fugitive on Interpol's "most wanted" list.
The new revelations are contained within an unpublished "info addendum" to a special audit by KPMG. Its main report was published in April, revealing the giant cash hole at the heart of Wirecard and precipitating the demise of the company. The 61-page addendum describes findings by KPMG that were not directly within its remit but that the firm deemed so significant it decided to report them anyway.
The addendum, seen by the Financial Times, amounts to a damning indictment of EY.
According to KPMG, EY's unnamed whistleblower in May 2016 filed a letter to EY Germany's headquarters in Stuttgart.
The letter did not address the whole extent of Wirecard's global fraud scheme that unravelled this year, but focused on one of four contentious areas that were the focus of KPMG's special audit in late 2019: a series of acquisitions in India that Wirecard had closed in early 2016.
Wirecard had paid €340 million ($606.4m) for Hermes i Tickets, GI Technology and Star Global, three payments companies that it bought from an opaque Mauritius entity named Emerging Market Investment Fund 1A.
The EY whistleblower asserted that "Wirecard Germany senior management" directly or indirectly held stakes in EMIF 1A and were therefore embroiled in a conflict of interest.
The whistleblower also accused senior Wirecard managers of artificially inflating the operating profit of the Indian businesses in an attempt to push up the acquisition price, which was partly linked to future profits. These performance-dependent "earn-outs" represented a third of the total price tag.
According to the whistleblower, the Wirecard manager who held a senior position at Hermes offered a local EY employee a "personal compensation" provided the auditor agreed to sign off on manipulated sales numbers.
An investigation by EY's anti-fraud team into the whistleblower report, codenamed "Project Ring", suffered from governance shortcomings, was terminated prematurely and left key questions unanswered, according to KPMG's review.
Similar allegations over Wirecard's acquisitions in India were eventually made in public by short sellers, but not until 2018. In the meantime, EY continued to audit Wirecard's accounts.
KPMG found that EY's 2017 audit of Wirecard's accounts was potentially flawed. Although Project Ring made several "observations" that cast doubt over the integrity of the financial reporting of Wirecard's Indian subsidiary, those findings were not properly scrutinised by EY's audit team that signed off Wirecard's 2017 results, according to KPMG.
"The examination of the observations by EY Audit was incomplete," KPMG wrote, adding: "KPMG sees evidence that argued against a termination of the Project Ring special audit and that should have been investigated conclusively."
The allegation of attempted bribery was apparently addressed only by EY internally — an approach that KPMG deemed problematic. "Given that the auditor [EY] was explicitly mentioned in the allegations, in our view mandating an independent third party was required," KPMG said.
Despite the fact that the whistleblower accused Wirecard's "senior management" in Germany of misconduct, the forensic audit was overseen by Wirecard's executive board rather than its supervisory board, KPMG found.
Stephan von Erffa, Wirecard's head of accounting and the only manager in Germany named by the whistleblower, was never formally interviewed and his email account was not analysed as Wirecard refused to give access to it.
A lawyer for von Erffa, who has been in police custody since July under suspicion of accounting fraud, embezzlement and market manipulation in the Wirecard scandal, did not respond to an FT request for comment. Von Erffa has previously denied any wrongdoing.
The Project Ring probe was ultimately ended in 2018 by Wirecard's chief operating officer Marsalek after he was informed about its problematic "observations".
Marsalek, who has been on the run from German police since June, portrayed EY's whistleblower letter as the action of a rogue employee. He told KPMG that an unnamed EY employee in India in 2016 had approached Wirecard, demanding "more assignments" for EY. According to Marsalek, the whistleblower letter was filed to EY shortly after Wirecard had turned down this demand.
EY replaced its local team of auditors in India but "to KPMG's knowledge" the allegation of attempted bribery "was not investigated" by EY, the report found.
"EY Audit . . . referred to a dispute between [a senior manager at Wirecard's Indian subsidiary] and the local auditors as well as to cultural peculiarities in India," wrote KPMG in its report, adding that EY did not share further information about an investigation into the bribery allegations. KPMG noted that EY should "at least" have interviewed the senior manager at Hermes.
"In such a situation, the appropriate step is an independent and comprehensive investigation by an independent third party," KPMG noted in its report, adding that EY itself was explicitly mentioned in the allegations.
In its Project Ring investigation, EY's fraud team made a number of "observations" that pointed towards potential balance sheet irregularities within Wirecard's Indian operations. Some of the whistleblower's allegations were corroborated by a second witness, EY told Wirecard.
Several findings suggested that profits may have been inflated. For instance, one-off items such as proceeds from the sale of internet domains and IT infrastructure were added to the operating profits with no clear justification.
Also, EY's fraud team discovered that €500,000 of interest income was added to the Indian group's earnings before interest, taxes, depreciation and amortisation — a gauge of operating profit that explicitly excludes interest.
In a status update that EY's fraud team shared with Wirecard's top management in March 2018, the investigation so far could neither confirm nor rebut the allegations but noted: "Some of the observations could potentially sustain some indicators of the allegation that selected revenues had a significant impact on ebitda, triggering higher earn-out payments to the seller of Hermes."
According to the KPMG report, EY's fraud team shared these "observations" with their colleagues who were auditing Wirecard's 2017 annual results — a team led by Andreas Loetscher, who later left the firm and is now Deutsche Bank's head of accounting.
However, EY's audit report for Wirecard's 2017 results, which was also seen by the FT, makes only a brief reference to the fraud accusations and the subsequent investigation. The audit report stated that the forensic investigation had been "concluded" without delivering "any evidence indicative of flawed accounting or other violations of law".
By contrast, KPMG was told by EY's fraud team that its investigation was not finished but was terminated at Wirecard's request and that no final report was produced. KPMG concluded that "key questions were left unanswered" and that problematic "observations" made during the investigation were not "conclusively processed".
EY told the FT: "The issues raised concerning the Hermes transaction were disclosed appropriately to members of the Wirecard supervisory and management boards. From all our internal reviews to date, we have determined that personnel from EY India and elsewhere conducted their procedures professionally and in good faith and there is no evidence of collusion. We are unable to comment further as this forms part of an ongoing investigation."
Loetscher and KPMG declined to comment.
Written by: Olaf Storbeck
© Financial Times