Case Study: KPMG Colombia's Improper Alteration of Audit Documentation (2016
PCAOB Inspection)
In December 2022, the Public Company Accounting Oversight Board (PCAOB) sanctioned
KPMG S.A.S. (KPMG Colombia), a member firm of the KPMG international network, for
violations related to the integrity of audit documentation. This case stemmed from events
during the PCAOB's 2016 inspection of the firm's audits for two issuers (referred to as Issuer
A and Issuer B). It highlights the critical importance of maintaining accurate, unaltered audit
documentation and the consequences of failing to do so in a real-world regulatory context.
What Happened?
Upon learning of the upcoming PCAOB inspection in 2016, KPMG Colombia personnel
improperly altered and backdated audit work papers for the Colombian components of Issuer
A's and Issuer B's audits. These changes were made after the required documentation
completion date (typically 45 days after the audit report release) to make it appear as though
the work had been completed earlier. Specific actions included:
Revising work papers without noting the date of the change, the person responsible, or the
reason for the alteration.
Using administrative passwords to backdate documents in the firm's electronic audit tool.
Submitting these modified work papers to PCAOB inspectors without disclosure, along with
false statements in engagement profiles claiming no post-completion changes had occurred.
Additionally, from 2016 to 2020, the firm had systemic issues with internal training, where
personnel shared answers to cheat on mandatory tests, further undermining the firm's quality
controls. These issues persisted due to inadequate monitoring and policies, affecting the
overall reliability of the firm's auditing practices.2cc90d
Violations
The PCAOB found KPMG Colombia in violation of several key rules and standards related to
audit documentation and quality control:
PCAOB Rule 4006 (Duty to Cooperate with Inspectors): By providing altered documents and
making false representations, the firm failed to cooperate fully with the inspection process.
Auditing Standard (AS) 3 (Audit Documentation): The firm did not assemble a complete and
final set of documentation by the completion date and improperly added information without
proper annotations.
Ethics Rule (ET) § 102 (Integrity and Objectivity): The alterations and misrepresentations
constituted knowing misrepresentations of facts, breaching professional integrity.
Quality Control (QC) Standards (§ 20, § 30, § 40): The firm's system lacked reasonable
assurance that personnel acted with integrity, monitored compliance effectively, and ensured
proper training and competencies. This included poor controls over passwords, archiving,
and detecting misconduct like answer-sharing in training.
These violations occurred over multiple years (2015–2019 for documentation issues and
2016–2020 for training), demonstrating ongoing deficiencies in the firm's internal
processes.adc167
Consequences
As a result of the investigation:
KPMG Colombia was censured by the PCAOB.
The firm was fined a $4 million civil money penalty, payable immediately, with potential
interest and registration suspension for non-payment.
Remedial actions were mandated, including revising policies within 90 days to ensure
documentation integrity, conducting an internal investigation into training cheating (to be
completed within 360 days), and engaging an independent consultant to review and
recommend improvements to quality controls.
The firm was required to notify all personnel of inspection obligations annually for six years
and report any future allegations of improper alterations for two years.
This was part of a broader $7.7 million enforcement action against multiple KPMG affiliates,
emphasizing the PCAOB's focus on global audit integrity.738cff688a08
Lessons Learned
This case underscores several key principles for auditing documentation:
Timely and Immutable Documentation: Audit work papers must be finalized by the
documentation completion date, with any subsequent changes clearly documented
(including who made them, when, and why) to maintain a reliable audit trail and comply with
standards like AS 3.
Robust Quality Controls:
Firms need strong systems (per QC § 20 and § 30) to monitor documentation processes,
control access (e.g., via passwords), and prevent alterations, ensuring audits meet
professional standards.
Integrity in Inspections:
Full cooperation with regulators, including transparent disclosure of any changes, is
essential to avoid violations of rules like PCAOB Rule 4006 and ET § 102.
Training and Monitoring:
Ongoing monitoring for ethical lapses, such as cheating in training, is crucial to uphold
personnel competencies (QC § 40) and overall audit quality.
Broader Implications:
Improper documentation not only leads to regulatory fines and reputational damage but also
erodes trust in financial reporting. Firms should prioritize standardization, accuracy, and
security in documentation practices to mitigate such risks.
