Britain’s accounting regulator has fined Deloitte £6.05 million over serious audit failures involving transport operator Go-Ahead Group across five financial years.
The Financial Reporting Council said Deloitte repeatedly failed to apply sufficient scrutiny to decisions by Go-Ahead subsidiaries that involved the retention and accounting treatment of more than £30 million in public money.
The audits covered the financial years from 2016 to 2020.
The regulator said the failures were particularly serious because Deloitte had itself identified several of the areas involved as significant audit risks.
FCRF Launches CP-FRM to Build India’s Next Generation of Fraud Risk Professionals
Original £11 Million Penalty Was Reduced
The FRC initially set the financial penalty at £11 million.
That amount was reduced to £6.05 million after a 10% discount for what the regulator described as exceptional cooperation and a further 35% reduction for Deloitte’s admissions and early resolution of the case.
Deloitte was also given a severe reprimand.
The FRC formally declared that the audit reports signed on Deloitte’s behalf for the 2016 to 2020 financial years did not meet the required auditing standards.
The firm has also been ordered to provide its FRC supervisor with a report explaining the root causes of the failures and the steps taken to prevent them from recurring.
Go-Ahead Subsidiary Retained Department for Transport Money
One of the central issues involved London & South Eastern Railway, or LSER.
The subsidiary had received erroneous overpayments from Britain’s Department for Transport under a rail franchise agreement before Deloitte became Go-Ahead’s auditor.
LSER was required to repay the money.
Instead, the FRC said the company retained it, created accounting accruals and later began releasing parts of those accruals into profit without informing the Department for Transport.
That practice continued after Deloitte took over as auditor.
£2.4 Million Was Released Into Profit in One Year
The FRC said LSER released £2.4 million of the retained overpayments into profit during the 2016 financial year.
It then accrued another £27 million between 2016 and 2020 under a later franchise agreement.
According to the regulator, evidence obtained during later audit years suggested that LSER management intended to release those later overpayments into profit if the Department for Transport did not discover them.
The regulator said Deloitte failed to sufficiently challenge what was happening.
Financial Statements Allegedly Disguised the Nature of the Money
The FRC also found that LSER classified the accruals in its 2019 and 2020 financial statements in a way that disguised their true nature.
The regulator said the company had an obligation under the franchise agreement to act in good faith.
Deloitte, as auditor, should therefore have considered whether LSER had an obligation to tell the Department for Transport about the money.
The FRC concluded that Deloitte failed to apply sufficient professional scepticism and did not properly assess indicators of fraud risk.
Government Later Recovered the Money
The Department for Transport became aware of LSER’s conduct in 2021.
It subsequently decided not to renew the company’s rail franchise when it expired.
The government also took steps to recover the retained funds and imposed a £23.5 million financial penalty on LSER.
The regulator’s case against Deloitte does not suggest that the accounting firm created the original overpayments.
The key allegation was that Deloitte’s audits failed to challenge how Go-Ahead subsidiaries subsequently handled and reported the money.
Another Subsidiary Released £5.6 Million Into Profit
A second Go-Ahead subsidiary, London & Birmingham Railway, was also examined.
The company held accruals for money that the Department for Transport did not know was owed to it under a separate rail franchise agreement.
After that franchise ended, the subsidiary released £5.6 million of those accruals into profit during the 2020 financial year.
The FRC said the company attempted to conceal the nature of that release through the wording used in its financial statements.
Deloitte again failed to investigate the circumstances sufficiently, according to the regulator.
Regulator Says Deloitte Missed Fraud Risk Indicators
The FRC said Deloitte failed to adequately evaluate evidence suggesting the existence of fraud risk factors.
Auditors are not expected to guarantee that no fraud exists.
But when financial records or management behaviour raise warning signs, auditors are required to investigate and challenge the information provided to them.
The regulator concluded that Deloitte failed to do that sufficiently across several years.
That distinction is important because the enforcement action is about the quality of Deloitte’s audit work, not about accusing Deloitte of participating in the underlying retention of public money.
German Rail Contracts Created Another Audit Problem
The FRC’s findings also involved Go-Ahead Bayern, another subsidiary operating rail services in Germany.
During the 2020 audit, Go-Ahead initially provided information showing that its German franchise contracts would generate losses.
The German component audit team concluded that Go-Ahead should recognise an onerous contract provision.
An onerous contract is one where the unavoidable costs of fulfilling the agreement are expected to exceed the economic benefits received.
Initially, the projected position showed a loss of €8 million.
Go-Ahead later supplied revised information that changed the valuation to a positive €3 million.
Deloitte Applied Insufficient Scrutiny to Revised Figures
The regulator said Deloitte did not adequately challenge the revised assumptions or explanations supporting the new figures.
An €8.1 million provision was eventually included in the 2020 financial statements.
But in the following year, that provision had to be restated to €49.5 million.
That was an increase of more than €40 million.
The FRC said Deloitte also failed to exercise sufficient oversight of the German component audit team and did not properly evaluate whether adequate audit evidence supported the final accounting treatment.
Failures Continued Across Five Audit Years
The regulator described the case as involving numerous breaches of auditing requirements.
Some continued across all five financial years under investigation.
The matters were also financially significant either at subsidiary or group level.
FRC Executive Counsel Penrose Foss said the failures showed a concerning pattern in Deloitte’s approach to clearly questionable decisions by Go-Ahead.
The involvement of large amounts of taxpayer money made the failures particularly serious, the regulator said.
Deloitte Admits Shortcomings
Deloitte acknowledged the regulator’s findings.
Reuters reported that the firm said it regretted that aspects of its audit work did not meet the required standards.
The company also pointed to improvements made to audit quality since the period covered by the investigation.
The settlement means Deloitte has admitted the identified failings rather than contesting them through a longer enforcement process.
The FRC’s original investigation had also covered Deloitte’s audit of Go-Ahead’s 2021 financial statements.
However, the regulator decided in December 2024 not to bring enforcement action in relation to that year.
The final sanctions therefore relate only to the 2016 through 2020 audits.
Audit Failures Can Allow Problems to Persist
Large listed companies rely on external auditors to independently test whether financial statements give investors and regulators an accurate picture of the business.
That role becomes especially important when management decisions involve unusual transactions or money owed to government bodies.
An auditor does not manage the company.
But it is expected to challenge questionable accounting decisions rather than simply accept management explanations.
The Go-Ahead case shows how weak professional scepticism can allow significant financial issues to remain unresolved across several reporting periods.
Public Money Makes the Case More Significant
The sums involved were not merely internal accounting entries.
More than £30 million belonged to the UK government.
That means the underlying issue ultimately involved taxpayer money.
The FRC said Deloitte’s failure to challenge the wrongful retention of those funds was one of the reasons for the unusually large financial sanction.
What this means for you
The Deloitte case shows why external audits matter beyond company shareholders. When auditors fail to challenge suspicious accounting decisions, problems involving public money, investors and regulators can continue for years before they are corrected.
Follow for daily updates on cybercrime, corporate fraud, DFIR, hacking, investigations, and digital forensics
